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Executive  Summary 


The  emergence  of  the  cyber  domain  as  the  newest  battlefront  of  war  suggests  the  need  to  examine 
this  unique  domain  along  with  the  various  interfaces  to  this  environment.  The  interface  to  the 
cyber  domain  occurs  through  technology  and  the  humans  that  use  the  technology.  Human  cyber 
behaviors  have  many  influences  including  kinetic  (physical  world)  events  as  well  as  the  interpre¬ 
tation  of  those  events.  Historically,  actors  responded  to  a  kinetic  event  with  a  kinetic  response  (in¬ 
cluding  actions  such  as  policy  changes).  Now,  actors  have  the  option  and  will  respond  to  a  kinetic 
event  with  a  cyber  response.  This  study  is  structured  to  allow  for  the  examination  of  actors  in¬ 
volved  in  cyber  events  (specifically  web  defacements)  where  those  events  relate  to  kinetic  activi¬ 
ties,  by  using  culture  as  the  framework  in  which  the  events  are  discussed.  This  study  was  designed 
to  profile  cyber  actors,  and  to  examine  the  time  interval  between  cyber  and  kinetic  events  in  order 
to  gain  greater  insights  into  nation-state  cyber  responses  to  kinetic  events. 

The  linkage  between  culture  and  cyber  behaviors  represents  a  new  area  of  cross-discipline  re¬ 
search  that  combines  the  disciplines  of  anthropology,  cybersecurity,  and  statistics.  Additionally, 
the  cyber  domain,  with  its  low  cost  of  entry  and  other  unique  characteristics,  may  benefit  from 
new  and  creative  ways  to  characterize  and  understand  events  taken  by  actors.  These  events  can  be 
placed  into  a  coherent  and  understandable  framework  that  allows  analysts  to  examine  and  ulti¬ 
mately  predict  how  an  adversary  will  be  inclined  to  behave  in  the  cyber  domain. 

This  study  was  focused  specifically  on  examining  the  relationship  between  cyber  and  kinetic 
events  through  the  lens  of  Hofstede’s  cultural  dimensions,  over  a  10-year  span  of  data  that  began 
on  January  1,  2004,  and  completed  on  December  3 1,  2013.  Due  to  the  relative  newness  of  the 
cyber  environment,  a  five-year  interval  was  also  examined  for  the  cyber  behavior.  This  was  due 
primarily  to  the  significant  increase  in  cyber  activity  beginning  at  year  2010. 

The  actors  were  divided  into  groups  based  on  the  activity  and  their  role  in  the  activity.  The  two 
event  activities  were  kinetic  and  cyber.  The  actors  were  identified  as  being  “source,”  “target,” 
“both-ST,”  and  “unpaired.”  Both-ST  actors  are  actors  who  were  both  source  and  target  actors  dur¬ 
ing  a  year;  the  intersection  of  the  source  and  target  actors.  Unpaired  actors  are  those  source  actors 
in  a  cyber-event  who  do  not  have  a  notable  kinetic  relationship  with  the  cyber  target. 

The  following  findings  are  supported  by  the  study’s  analysis: 

•  Source  actors  tend  to  come  from  authoritative,  restrained  societies  that  deal  aggressively 
with  conflict,  but  tend  to  behave  in  ways  that  follow  the  norms  of  their  society. 

•  Target  countries  also  tend  to  deal  aggressively  with  conflict  but  are  authority  neutral.  That  is, 
when  the  situation  demands,  these  actors  will  act  on  their  own  and  not  necessarily  seek  per¬ 
mission  for  their  actions. 

•  Unpaired  actors  had  similar  cultural  profiles  to  the  source  actors. 

•  Indulgence  (acceptance  of  individual  behavior  that  deviates  from  norms)  strongly  correlates 
to  a  longer  time  interval  between  cyber  and  kinetic  events. 
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While  the  cyber  data  analyzed  here  is  limited  to  website  defacements,  and  many  of  the  cyber  ac¬ 
tors  use  other  attack  vectors,  the  results  do  reveal  statistical  differences  by  national  cultural  val¬ 
ues.  These  differences  will  ultimately  require  further  exploration  to  gain  a  more  complete  under¬ 
standing  of  cyber  behaviors  and  the  role  that  culture  plays  in  influencing  those  behaviors. 
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Abstract 


This  study  examines  the  relationship  between  cyber  and  kinetic  events  through  the  lens  of  Hof- 
stede’s  cultural  dimensions,  over  a  10-year  span  of  data  that  began  on  January  1,  2004,  and  com¬ 
pleted  on  December  3 1,  2013.  Due  to  the  relative  newness  of  the  cyber  environment,  a  five-year 
interval  was  also  examined  for  the  cyber  behavior.  This  was  due  primarily  to  the  significant  in¬ 
crease  in  cyber  activity  beginning  at  year  2010. 

This  study  is  structured  to  allow  for  the  examination  of  actors  involved  in  cyber  events  (specifi¬ 
cally  web  defacements)  where  those  events  relate  to  kinetic  activities,  by  using  culture  as  the 
framework  in  which  the  events  are  discussed.  This  study  was  designed  to  profile  cyber  actors,  and 
to  examine  the  time  interval  between  cyber  and  kinetic  events  in  order  to  gain  greater  insights  into 
nation-state  cyber  responses  to  kinetic  events. 

The  study  results  present  findings  about  the  relationships  of  cultural  values  and  the  cyber  and  ki¬ 
netic  actions  that  have  been  observed  and  recorded. 
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1  Introduction 


This  report  is  based  on  a  seedling  study  that  examined  the  relationship  between  national  culture 
and  cyber  behaviors  as  these  factors  relate  to  physical  or  kinetic  events  (actions  in  the  real  world, 
including  things  like  policy  changes).  The  goal  was  to  determine  if  a  statistical  relationship  exists 
between  culture  and  the  time  between  cyber  and  kinetic  events.  This  required  specific  definitions 
for  these  terms — culture,  cyber  events,  and  kinetic  events.  Additionally,  the  ability  to  characterize 
various  actor  groups  was  also  necessary;  therefore,  four  different  types  of  actors  were  character¬ 
ized  in  this  study. 

The  study  of  the  relationship  between  culture  and  cyber  behaviors  represents  a  new  area  of  cross¬ 
discipline  research  that  combines  the  disciplines  of  anthropology,  statistics,  and  cybersecurity.  By 
combining  these  disciplines,  a  new  dimension  may  be  added  to  threat  intelligence  that  allows  for  a 
different  perspective  that  may  provide  new  insights  into  adversary  thought  patterns.  Furthermore, 
the  statistical  component  allows  for  extrapolation  of  results  that  may  be  used  to  address  new  ways 
to  characterize  and  anticipate  action  by  an  adversary  through  an  understanding  of  national  culture. 

The  short  nature  of  this  study  leaves  open  many  potential  follow-on  studies  that  can  further  exam¬ 
ine  many  aspects  that  are  not  addressed  here,  such  as  the  nature  of  the  cyber  events,  escalation 
patterns,  retaliation  patterns,  tool  choices,  and  any  other  interesting  battle  front  behaviors  in  the 
cyber  domain. 

1.1  Objectives 

The  overall  objective  of  this  study  is  to  understand  and  document  the  relationship  between  spe¬ 
cific  cyber  behaviors  (website  defacements)  that  are  related  to  kinetic  events  and  cultural  values 
that  have  been  quantitatively  defined  by  Hofstede,  Hofstede,  and  Minkov  in  Cultures  and  Organi¬ 
zations  [Flofstede  2010],  Specifically,  this  study  is  being  performed  to  determine  if  a  statistical 
relationship  exists  between  culture  and  the  time  between  cyber  and  kinetic  events.  If  statistical 
correlations  exist  between  cyber  and  kinetic  events,  then  a  possible  early  warning  system  may  be 
established  that  could  be  informed  by  the  results  of  this  study. 

Understanding  how  the  national  values  of  populations  relate  to  specific  cyber  behaviors  offers  the 
unique  potential  to  understand  and  engage  nations  in  the  cyber  domain.  Understanding  the  na¬ 
tional  culture  or  what  Hofstede  et  al.  refer  to  as  the  “mental  programming”  of  a  population  pro¬ 
vides  unique  insights  when  dealing  in  conflict  areas  [Hofstede  2010].  These  insights  may  be  used 
to  ultimately  forecast  or  anticipate  what  events  will  lead  to  a  tipping  point  and  when  those  events 
are  likely  to  occur. 
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2  Structure  of  this  Report 


2.1  Background 

Beidleman  observed,  “cyberspace  has  emerged  as  a  setting  for  war  on  par  with  land,  sea,  air  and 
space”  [Beidleman  2009].  The  virtual  nature  of  the  cyber  domain  automatically  implies  that,  un¬ 
like  the  physical  domains  of  land  and  sea  where  physical  strength  is  a  critical  component,  the 
cyber  domain  requires  mental  strength  and  agility.  The  mental  processing  that  takes  place  in  the 
cyber  domain  far  exceeds  the  cognitive  norm  of  40-60  bits  per  second  [Dijksterhuis  2004];  thus, 
operators  in  this  domain  will  likely  rely  on  automatic  (unconscious)  thought  processes.  The  auto¬ 
matic  thought  processing  system  has  been  shown  repeatedly  in  research  to  be  culturally  biased 
[Bargh  2008,  Baumeister  2010,  Evans  2008,  Guess  2004,  Guss  2010]. 

Thus,  even  though  the  hardware  is  universal  and  much  of  the  software  is  also  universal,  the  usage 
patterns  will  vary.  Hofstede  et  al.  said,  “This  dominance  of  technology  over  culture  is  an  illusion. 
The  software  of  the  machines  may  be  globalized,  but  the  software  of  the  minds  that  use  them  is 
not”  [Hofstede  2010,  p.  391]. 

Hofstede’s  cultural  dimensions  framework  is  a  quantitative  framework  for  defining  national  cul¬ 
tural  values.  Hofstede’s  framework  is  universally  recognized,  and  while  this  framework  does  have 
critics,  the  widespread  adoption  of  this  framework  by  both  public  and  private  sectors  indicates 
that  the  framework  does  have  merit.  One  of  the  most  common  complaints  about  Hofstede’s  cul¬ 
tural  dimensions  framework  centers  on  the  fact  that  the  participants  did  not  reflect  an  economic 
cross-section  of  the  society;  instead,  most  participants  were  engineers.  While  this  could  be  a  prob¬ 
lem  in  some  studies,  the  vast  majority  of  hackers  have  a  background  that  can  be  defined  as  engi¬ 
neering  or  an  engineering-related  discipline. 

Each  of  these  six  cultural  dimensions  associates  with  specific  behaviors.  A  full  explanation  is  con¬ 
tained  in  Hofstede’s  work  (see  Hofstede  et  al.  or  the  Country  Comparison  page  on  the  Geert-Hof- 
stede  website  for  more  details)  [Hofstede  2013]. 

Hofstede’s  six  dimensions  of  culture  are: 

1 .  Power  distance  (PDI)  -  deals  with  the  source  of  power  in  a  society.  In  low  power  distance 
countries,  power  comes  from  the  citizens  and  is  conferred  upon  the  leaders — these  countries 
are  considered  egalitarian.  In  high  power  distance  countries,  power  originates  at  the  leader¬ 
ship  level  and  is  passed  down  to  the  citizens. 

2.  Individualism  versus  collectivism  (IVC)  -  deals  with  the  considerations  an  individual  uses 
when  making  decisions.  In  the  collectivist  society,  the  individual  considers  the  impact  of  his 
or  her  decisions  on  the  larger  group  before  making  a  decision.  In  the  individualist  society, 
the  individual  makes  decisions  based  on  his  or  her  needs  or  the  needs  of  his  or  her  family, 
but  not  the  greater  society. 

3.  Masculine/feminine  (M/F)  -  deals  with  the  conflict  and  competition.  The  masculine  culture 
deals  directly  with  conflict  and  tends  toward  aggressive  behavior.  The  feminine  culture  is 
more  nurturing  and  prefers  to  negotiate  conflicts. 
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4. 


Uncertainty  avoidance  (UAI)  —  deals  with  how  the  society  deals  with  the  new  or  unknown. 
Low  UAI  societies  treat  the  unknown  as  a  curiosity  that  should  be  explored.  High  UAI  socie¬ 
ties  fear  the  unknown,  which  results  in  attempts  to  remove  or  neutralize  the  unknown. 

5.  Long-term  orientation  versus  short-term  orientation  (LvS)  —  deals  with  the  outlook  and  effort 
of  a  society.  The  long-term-oriented  society  is  patient  and  takes  a  holistic  approach  to  prob¬ 
lem  solving.  The  short-term-oriented  society  is  characterized  by  short  timelines  and  direct 
approaches  to  problem  solving. 

6.  Indulgence  versus  restraint  (IVR)  —  deals  with  how  accepting  the  society  is  about  behavior 
that  deviates  from  the  norm. 

The  relative  youth  of  this  cross-discipline  research  area  has  made  collection  of  accurate  raw  data 
challenging.  Valeriano  and  Maness  (2014)  collected  a  comprehensive  set  of  data  on  cyber  con¬ 
flicts,  and  they  also  noted  the  difficulty  in  collecting  unbiased  or  ground  truth  data  (GTD)  [Valeri¬ 
ano  2014].  This  lack  of  primary  data,  or  raw  data,  introduces  problems  when  attempting  to  meas¬ 
ure  and  evaluate  events,  since  the  news  reports  are  secondary  data  and  not  necessarily  GTD. 

One  early  example  of  a  quantitative  study  on  cyber  behaviors  originated  with  Woo  [Woo  2003], 
Woo  relied  on  a  source  of  GTD  that  has  been  widely  used  in  academia,  the  Zone-H  dataset  of 
website  defacements.  Woo  divided  website  defacements  into  two  general  types,  merry  pranksters 
and  patriotic  hackers.  Of  this  second  group  of  hackers,  patriotic.  Woo  speculated,  “defacing  the 
‘out-groups’  Web  sites  with  aggressive  messages  or  violent  threats  may  strengthen  the  feelings  of 
identification  or  self-esteem  the  hackers  have  with  their  own  group”  [Woo  2004,  p.  68].  The 
recognition  of  “in  group”  and  “out  group”  treatment  is  a  term  that  Hofstede  et  al.  uses  to  define 
behaviors  that  associate  with  high  power  distance  (PDI)  and  individualism  versus  collectivism 
(IVC)  [Hofstede  2010], 

Woo’s  study  helped  to  inform  Sample’s  study  [Sample  2013].  An  artifact  of  Woo’s  2004  study  is 
the  data  now  found  at  the  Zone-H  website  (http://www.zone-h.org).  Subsequently,  Sample  used 
Hofstede’s  cultural  dimensions  to  statistically  link  the  relationship  between  nationalistic,  patriotic- 
themed  website  defacements  (NPTWDs)  and  high  PDI.  Follow-on  studies  by  Sample  and  Kara- 
manian  reinforced  the  20 1 3  findings  and  linked  other  online  behaviors  with  dimensional  values 
defined  by  Hofstede  [Sample  2014], 

2.1.1  Definitions 

“Both-ST”  Actors  -  actors  who  are  both  source  and  target  actors;  the  intersection  of  the  source 
and  target  actors 

Cohen’s  Coefficient  —  Cohen’s  coefficient  is  the  standard  interpretation  used  to  determine  the  na¬ 
ture  of  statistical  relationships  (mild,  moderate,  or  strong)  for  human  behavior  [Cohen  1988].  Co¬ 
hen  defined  a  range  of  |0.1  -  0.3|  as  a  weak  correlation  between  variables,  a  range  of  |0.3  -  0.5|  as 
a  moderate  correlation  between  variables,  and  |>=0.5|  as  a  strong  correlation  between  variables. 

Country  Pairs  -  yearly  list  of  source  and  target  countries  involved  with  kinetic  conflict  activities 

Culture  -  “The  collective  mental  programming  that  distinguishes  one  group  of  people  from  an¬ 
other”  [Hofstede  2010,  p,  6].  This  study  focuses  on  national  culture  only. 

Cyber  Event  -  website  defacement  (as  limited  for  the  purposes  of  this  study) 
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Event  Pairs  -  list  of  nearest  pair  dates  between  cyber  and  kinetic  events 


Kinetic  Event  —  physical  action  or  event  including  verbal  exchanges  and  policy  changes  between 
source  and  target  actors 

Mann-Whitney  U-test  —  a  non-parametric  comparison  test  that  compares  median  values  and  rank 
orders  values  from  two  groups,  resulting  in  a  z-score  that  can  be  translated  into  a  probability  value 
(p-value)  that  is  used  to  evaluate  statistical  significance  of  findings.  This  test  is  used  for  group 
comparisons. 

Source  Actors  -  actors  involved  in  a  cyber  or  kinetic  conflict  pair  who  perform  an  attributed  at¬ 
tack  on  the  target  of  the  pairing 

Spearman  Correlation  —  a  non-parametric  test  that  measures  the  dependency  relationship  be¬ 
tween  two  variables,  provided  by  the  r-value.  This  test  will  be  used  to  evaluate  trends  and  timing 
intervals. 

Statistical  Significance  —  refers  to  the  probability  of  randomly  attaining  the  same  results,  typi¬ 
cally  values  of  less  than  0.05  or  5% 

Target  Actors  —  actors  involved  in  a  cyber  or  kinetic  conflict  pair  who  are  the  victim  of  an  attack 
attributed  to  the  source  of  the  pairing 

Unpaired  Actors  —  actors  who  perform  a  cyber-attack  against  a  target  host,  but  are  not  involved 
in  a  kinetic  conflict  pair  with  that  target 

2.2  Approach  and  Data 

This  study  has  several  key  components  that  must  be  joined  together  to  provide  relevant  results: 

•  the  actual  kinetic  events  as  listed  in  Integrated  Crisis  Early  Warning  System  (ICEWS) 

•  the  specified  cyber  events  that  have  been  extracted  from  Zone-H  archives 

•  the  cultural  values  overlay  provided  by  Hofstede 

•  the  quantitative  component,  the  statistical  tools 

The  process  of  determining  the  group  pairings  and  event  pairings  is  an  iterative  process,  as  ex¬ 
plained  when  the  filtering  process  is  described  later  in  this  document. 

The  ICEWS  dataset  provides  the  kinetic  event  data  for  this  study.  The  ICEWS  dataset  is  public 
and  freely  available  and  contains  all  of  the  global  news  stories  used  in  this  study.  At  the  time  of 
data  collection,  the  ICEWS  data  resided  at  the  Teamforge  website  (https://teamforge.atl. exter¬ 
nal. lmco.com/)  managed  by  Lockheed  Martin;  subsequently  the  ICEWS  data  may  now  be  found 
at  https://dataverse.harvard.edu/dataverse/icews. 

The  event  intensity  values  are  defined  in  the  Conflict  and  Mediation  Event  Observations 
(CAMEO),  and  Actor  Codebook  contains  the  actor  description  fields  along  with  the  event  inten¬ 
sity  scoring.  The  event  intensity  scoring  relies  on  the  Goldstein  scale.  The  Goldstein  scale  was 
created  in  1992  by  Joshua  Goldstein,  and  is  used  by  ICEWS  to  describe  the  intensity  of  conflict  or 
cooperation  found  in  various  international  events  [Goldstein  1992].  This  study  will  rely  on  the 
conflict  events  and  will  ignore  the  cooperative  events. 
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As  noted,  the  cyber  data  was  collected  from  the  Zone-H  archives.  The  website  http://www.zone- 
h.org  makes  freely  available  a  list  of  defacements  of  the  last  60  days.  However,  the  entire  archive 
is  commercially  available,  and  was  purchased  for  this  study.  This  archive  contains  the  links  to  the 
mirror  sites  that  are  created  for  each  website  defacement.  Access  to  the  entire  archive  mirror  site 
was  purchased  for  this  project. 

The  final  group  of  data  required  for  this  study  was  the  cultural  values  data.  Hofstede’s  cultural 
values  data  is  made  freely  available  to  researchers  from  his  website, 

http://www.geerthofstede.eu/dimension-data-matrix.  Hofstede’s  data  is  limited  to  nations;  only 
1 00  nations  are  scored. 

Building  on  this  knowledge,  the  cyber  early  warning  study  will  examine  cyber  behaviors  in  terms 
of  Hofstede’s  cultural  dimensions  framework.  The  approach  is  part  quasi-experiment  for  group 
comparisons,  part  correlational  analysis,  and  part  trend  analysis.  This  approach  of  using  both 
group  comparisons  and  correlational  analysis  is  done  to  determine  if  a  statistically  relevant  rela¬ 
tionship  can  be  inferred,  and  if  so,  to  what  degree  this  relationship  can  be  measured.  The  first  part 
of  the  analysis,  the  comparison  of  defacement  participation  against  the  global  country  distribution, 
is  a  simple  quasi-experiment.  This  approach  is  chosen  because  the  group  of  countries  being  exam¬ 
ined  is  not  random;  rather,  the  countries  have  passed  criteria  of  both  being  found  in  Hofstede’s 
framework  and  have  event  intensity  values  between  -5  and  -10. 

The  correlational  analysis  relies  on  a  sufficient  number  of  dependent  variable  entries  (countries) 
and  corresponding  cyber  characteristics,  such  as  the  time  between  events.  This  study  relies  on 
public  data  collected  on  both  cyber  and  kinetic  events  in  conflict  regions.  The  dates  of  kinetic  and 
cyber  events  provide  the  inputs  that  result  in  the  (time)  “delta”  between  events.  The  delta  values 
are  examined  against  Hofstede’s  cultural  values. 

The  reliance  on  quantitative  analysis  is  chosen  to  reduce  the  risk  of  cultural  and  personal  bias  in¬ 
jection  by  the  researcher.  This  research  focuses  on  both  cyber  and  kinetic  events  between  country 
pairs  that  have  been  identified  as  being  in  conflict  with  each  other  through  ICEWS  data.  The  list 
of  country  pairs  informs  the  cyber  search  parameters.  Explanations  for  behaviors  are  provided 
once  the  quantitative  analysis  has  been  performed. 

2.3  Scope  and  Limitations 

The  short  nature  of  this  study,  combined  with  the  requirement  for  GTD,  limits  the  data  to  well- 
known  sources  of  good  data.  Thus,  the  use  of  ICEWS  and  Zone-H  datasets  provides  the  necessary 
good,  academically  acceptable  GTD.  Unfortunately,  though,  the  Zone-H  data  is  limited  to  deface¬ 
ments  only.  This  results  in  a  subset  of  overall  cyber  activities,  excluding  intrusions,  denial  of  ser¬ 
vice  (DoS)  attacks,  malware,  phishing  schemes,  infrastructure  attacks,  and  other  attacks.  Many  of 
these  attack  vectors  are  currently  being  used  by  various  nation-state  groups  and  would  undoubt¬ 
edly  provide  fascinating  data,  but  due  to  time  and  quality  constraints  could  not  be  included  for  this 
study. 

2.4  Method 

This  study  examines  cultural  behaviors  based  on  national  culture,  due  to  the  reliance  on  Hof¬ 
stede’s  framework.  The  study  examines  data  from  January  1,  2004  through  December  3 1,  2013. 
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Additionally  this  study  is  scoped  to  examine  events  between  countries  only.  The  research  method 
will  be  discussed  below  in  terms  of  two  distinct  areas:  data  collection  and  data  processing. 

2.4.1  Data  Collection 

Data  collection  relies  on  the  use  of  two  large  sets  of  event  data,  the  ICEWS  listing  of  kinetic 
events  and  the  Zone-H  defacement  archives,  along  with  the  smaller  set  of  Hofstede  data.  ICEWS 
stored  event  data  in  one-year  increments  and  Zone-H  stores  data  in  monthly  file  increments  for 
each  year.  The  years  2004-20 1 3  are  being  studied,  representing  1 0  years  of  activity.  Initial  data 
collection  relies  on  the  intersection  of  these  different  groups  of  data.  The  first  intersection  relies 
on  the  intersection  of  Hofstede’s  100  countries  and  the  entire  ICEWS  database  for  each  of  the  10 
years. 

2.4.2  ICEWS  Data  Collection  and  Filtering 

The  ICEWS  data  is  grouped  by  yearly  increments  and  is  sorted  by  the  GTD  value,  which  is  chron¬ 
ologically  assigned,  based  on  the  date  of  the  news  story.  The  pre-filters  for  the  ICEWS  data  re¬ 
quire  three  cases: 

•  The  conflict  event  must  occur  between  two  different  countries.  This  rule  is  in  place  to  prevent 
internal  conflicts  from  a  nation  (such  as  a  coup,  riots,  protests,  etc.)  from  being  processed  as 
an  international  event. 

•  Both  source  and  target  countries  must  be  found  in  Hofstede’s  list  of  100  countries.  This  rale 
is  in  place  because  Hofstede  provides  the  cultural  scoring  data  that  is  required  for  statistical 
processing. 

•  The  event  intensity  score  must  be  -10  <  x  <  -5.  The  values  are  represented  as  real  numbers; 
thus,  some  values  contain  decimal  values.  These  events  represent  active  hostile  kinetic  events. 
A  list  of  some  example  events  and  intensity  follows. 

-10:  Conduct  suicide,  car,  or  other  non-military  bombing;  fight  with  small  arms  or  weapons 

-9:  Torture;  use  unconventional  violence 

-8:  Impose  embargo,  boycott,  or  sanctions 

-7 :  Give  ultimatum;  protest  violently,  riots 

-6:  Demonstrate  or  rally  (-6.5) 

-5 :  Demand;  arrest,  detain,  or  charge  with  legal  action 
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Figure  1:  Pre-Filtering  Illustration  for  ICE WS  Data 

Upon  completion  of  the  pre-filtering  rules  for  ICEWS  data,  the  initial  yearly  file  of  kinetic  events 
was  significantly  reduced.  Table  1  provides  the  total  number  of  events  per  year  before  pre-filter¬ 
ing  (All  Kinetic  Events)  and  the  number  of  records  resulting  from  applying  the  pre-filtering  rules 
(Pre-Filtered  Kinetic  Events). 


Table  1:  ICEWS  Pre-Filtering  Data  Reduction  Results 


Year 

All  Kinetic  Events 

Pre-Filtered  Kinetic  Events 

2004 

1,318,319 

62,594 

2005 

1,310,096 

46,885 

2006 

1,426,290 

71,464 

2007 

1,440,251 

52,929 

2008 

1,438,869 

56,771 

2009 

1,354,533 

50,607 

2010 

1,252,587 

46,936 

2011 

1 ,227,643 

45,215 

2012 

1,325,988 

48,064 

2013 

1 ,334,332 

46,268 

A  quick  inspection  of  this  data  shows  the  peak  activity  year  for  the  “pre-filtered”  events  file  was 
2006.  Over  time  the  number  of  kinetic  events  between  nations  decreased.  Of  note:  2007  had  the 
most  kinetic  events.  Fiowever,  after  the  pre-filtering,  2006  was  the  most  active  year.  This  may 
suggest  that  2007  had  certain  countries  that  may  have  had  significant  internal  activity.  Another 
possible  explanation  could  be  that,  in  the  examined  conflicts,  either  the  source  or  target  could  not 
be  found  in  Fiofstede’s  data.  As  time  increased,  the  correlation  between  time  and  the  number  of 
kinetic  events  showed  a  strong  negative  correlation.1 


1  While  data  was  being  statistically  analyzed,  the  correlation  was  run  to  examine  year  and  number  of  kinetic  event 
trends.  The  analysis  revealed  a  significant  negative  correlation  (r  =  -0.6),  so  as  time  moves  forward,  the  number  of 
kinetic  events  decreases. 
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2.4.3  Pre-Filtering  Rules  for  Zone-H  Data 


The  Zone-H  data  is  grouped  by  months.  Most  attackers  self-report,  using  their  online  identity,  and 
provide  the  attack  motive  along  with  other  relevant  information.  There  are  seven  different  attack 
motives  from  which  to  choose;  only  the  three  in  bold  type  were  applied  as  pre-filter  rules  for  this 
study  since  they  appeared  to  have  a  political,  patriotic,  or  related  motive  that  could  associate  with 
the  ICEWS  kinetic  events. 

•  Hey. .  .just  for  fun. 

•  Revenge  against  that  website 

•  Political  reasons 

•  Asa  challenge 

•  I  just  want  to  be  the  best  defacer 

•  Patriotism 

•  Not  available 

The  monthly  defacement  data  was  aggregated  into  years.  Then  the  data  was  pre-filtered  to  only 
include  the  three  motives  described  above.  Table  2  provides  the  original  number  of  all  defacement 
events  for  each  year  as  well  as  the  number  of  events  resulting  from  applying  the  pre-filtering  of 
the  motives. 

Table  2:  Zone-H  Data  Initial  Filtering  Results 


Year 

All  Defacement  Events 

Pre-Filtered  Defacement  Events 

2004 

392,460 

113,699 

2005 

493,721 

132,170 

2006 

752,036 

120,145 

2007 

480,623 

69,550 

2008 

517,405 

102,121 

2009 

544,097 

136,696 

2010 

1,419,382 

161,483 

2011 

1,608,922 

290,523 

2012 

1,079,739 

208,795 

2013 

1,398,291 

158,490 

A  quick  inspection  of  this  data  shows  the  peak  activity  year  for  pre-filtered  defacement  events 
was  2011.  However,  when  the  number  of  pre-filtered,  or  state-related  defacements  are  considered 
as  a  proportion  of  the  total  number  of  defacements,  the  most  active  years  were  2004  (29%),  2005 
(27%),  and  2009  (25%),  respectively.  As  time  increased,  the  correlation  between  time  and  the 
proportion  of  state  defacement  showed  a  strong  negative  correlation.2  This  could  possibly  suggest 


2  While  data  was  being  statistically  analyzed  the  correlation  was  run  to  examine  year  and  percent  motivated  deface¬ 
ment  trend.  The  analysis  revealed  a  significant  negative  correlation  (r  =  -0.6),  so  as  time  increases,  the  percent  of 
defacements  for  a  cause  decreases. 
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that  web  defacements  for  a  cause  became  a  relatively  less  popular  attack  vector  over  time  as  at¬ 
tackers  grew  in  knowledge  and  sophistication. 

2.4.4  ICEWS  Filtering 

The  filtering  of  the  ICEWS  data  was  an  iterative  process  that  took  three  rounds.  In  each  case,  the 
filters  were  based  on  meta-fields  that  allowed  for  the  elimination  of  classes  of  events  based  on  ei¬ 
ther  the  actor  or  the  activity;  this  was  done  to  avoid  time-intensive  manual  review  of  news  stories. 
In  eliminating  manual  reviews  of  the  news  stories,  operator  error  and  researcher  biases  should  be 
decreased  if  not  eliminated.  The  filters  were  performed  on  the  “Source  Sector,”  “Target  Sector,” 
and  “Event  Text”  meta-fields. 

2.4.5  Filter  1 

The  first  filter  deals  with  the  unknown  or  unattributed  actors  and  passive  events.  Filter  1  filtered 
out  “NULL”  and  “Unidentified”  source  and  target  sectors — this  reflects  the  inability  to  associate 
those  actors  to  a  nation.  The  event  text  filter  for  the  first  round  was  “Deny  responsibility.”  This 
filter  was  chosen  due  to  the  passive  or  non-active  role  of  the  behavior — denying  responsibility  for 
an  action  could  simply  be  due  to  an  incorrect  attribution  or  an  incorrect  charge.  Regardless,  deny¬ 
ing  responsibility  would  not  reflect  the  initiation  of  a  kinetic  event  between  a  source  and  target 
country.  Upon  application  of  the  first  filters,  the  events  files  were  significantly  reduced.  Table  3 
details  the  reductions  per  year  upon  completion  of  the  first  filter. 

Table  3:  ICEWS  Reductions  from  First  Filter  Set 


The  second  group  of  kinetic  filters  for  source  and  target  sectors  dealt  with  non-govemmental  or¬ 
ganizations,  human  rights  groups,  criminals,  religious  groups,  the  media,  and  medical  groups. 
Non-governmental  groups  and  religious  groups  operate  outside  the  authority  of  a  national  govern¬ 
ment.  While  some  countries  do  have  a  close  relationship  between  an  approved  religion  and  that 
religion  may  influence  laws  (i.e.,  the  Catholic  Church  and  Ireland,  Shiite  Muslims  and  Iran),  the 
religion  seeks  to  influence  the  nation,  not  the  inverse,  and  the  religion  crosses  international  bor¬ 
ders.  Table  4  contains  the  list  of  sector  filters  and  the  justification  for  their  implementation. 
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Table  4:  Filters  on  Actors  Used  for  Second  Set  of  Filters 


Sector  Filter  Type 

Justification  for  Removal 

Nongovernmental  Organization 
(NGO) 

These  groups  are  not  under  the  control  of  any  national  government. 

Media 

These  groups  may  report  stories  but  typically  do  not  initiate  an  action  that 
can  be  considered  an  act  of  aggression.  Additionally,  in  many  countries  a 
free  press  is  considered  necessary,  and  as  such  they  are  widely  viewed  as 
not  political. 

Medical 

Medical  groups  such  as  the  Red  Cross  provide  relief  in  natural  disasters,  or 
relief  to  refugees  in  camps.  These  groups  do  not  initiate  hostile  actions  on 
behalf  of  their  government. 

Criminal 

Criminals  are  everywhere  and  operate  outside  the  laws  of  their  given  coun¬ 
try.  Criminal  acts  such  as  robbery  may  cross  borders  but  do  not  typically 
cause  international  incidents. 

Terrorist 

Terrorists  operate  outside  of  the  government. 

Sexual  Assault 

While  rape  is  often  a  weapon  of  war,  the  sexual  assaults  found  in  the  event 
data  was  of  the  criminal  nature  not  as  a  weapon  of  war. 

Afro-Caribbean 

This  deals  with  a  multi-national  group,  outside  of  the  control  of  any  specific 
national  government. 

Agricultural,  Social 

Agricultural  actor  stories  have  typically  dealt  with  farming  issues.  While  these 
could  lead  to  escalation  the  events  observed  covered  health  related  issues 
(e.g.,  bird  flu). 

Banned  Parties 

Banned  political  parties. 

Business,  Social; 

Consulting 

Businesses  and  consulting  groups,  not  transacting  with  governments,  basic 
commerce  issues. 

Chechen 

Chechen  rebels  are  not  under  the  direction  of  a  national  government  found  in 
Hofstede's  list  of  countries.  They  may  launch  attacks  from  other  countries 
but  the  government  does  not  endorse  nor  support  the  attacks. 

Coptic 

A  religious  sect. 

Druze 

A  middle  east  religious  sect. 

Drugs 

Criminal  drug  groups. 

Exiles 

A  group  of  people  removed  from  their  home  country.  The  new  host  country  is 
not  responsible  for  their  actions. 

Far  Left,  Social,  Ideological,  Print, 
News,  Media 

Leftist  propaganda. 

Food  Ministry 

These  stories  had  more  to  do  with  contaminated  food  (bird  flu,  mad  cow,  Fu- 
kishima). 

Fulani,  Fulbe,  International  Ethnic 

An  ethnic  group  of  people  in  west  Africa. 

International  Government  Organi¬ 
zations  (IGO) 

Groups  that  operate  as  international  cooperative  agencies.  They  are  not  un¬ 
der  the  direction  of  any  one  government. 

Health  Ministry 

Government  group  charged  with  maintaining  the  health  of  the  citizens.  This 
agency  is  not  associated  with  acts  of  aggression  but  they  have  international 
involvement  typically  when  treating  victims.  Also  may  provide  information  to 
other  groups  in  government  that  may  lead  to  a  kinetic  event,  but  the  group  is 
not  responsible  for  the  events. 

Dissident,  Criminals 

Dissidents  who  engage  in  criminal  activities. 

International  Dissident 

Dissidents  who  engage  in  criminal  activities  in  various  countries. 
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Sector  Filter  Type 

Justification  for  Removal 

International  Ethnic 

Groups  of  people  who  may  reside  in  one  nation  but  are  not  fully  integrated 
into  that  nation;  these  groups  are  not  typically  supported  by  the  government. 

International  Religious: 

Jewish,  Muslim,  Christian 

Muslims,  Christians,  Jews  and  other  groups.  These  groups  operate  both  in 
and  outside  national  borders;  they  are  independent  of  a  national  govern¬ 
ment. 

Labor  NGOs 

Non-governmental  labor  organizations,  concerned  with  workers'  rights. 

Labor,  Social 

Groups  concerned  with  workers’  rights,  unions,  and  trade  associations. 

Organized  Violent  Criminals 

Organized  criminals  that  are  not  part  of  the  military. 

Radicals 

Not  under  the  control  of  the  national  government. 

Refugees 

Not  citizens  of  the  country  where  they  are  located. 

Regional  Diplomatic  (IGO) 

Not  representative  of  a  specific  government  (e.g.,  NATO). 

Religious  Diplomatic  (IGO) 

Not  representative  of  a  specific  government  (e.g.,  Pope). 

Religious  Minority 

Operates  outside  the  authority  of  the  national  government. 

Separatists 

Splinter  group  that  does  not  recognize  the  national  government. 

Shia/ldeological 

Muslim  group  that  may  indirectly  influence  the  national  government  but  does 
not  take  responsibility  for  that  government.  They  also  operate  outside  the  au¬ 
thority  of  the  national  government. 

Social* 

(as  defined  by  ICEWS) 

*  Agricultural,  Business,  Chechen, 
Dissident  Far  Left,  Far  Right,  Gen¬ 
eral  Population,  Ideological,  Inter¬ 
national  Ethnic,  Labor,  Media, 
Muslim,  Shia,  Sunni 

Individuals  or  small  groups  that  are  citizens  of  a  nation  but  are  acting  inde¬ 
pendently. 

South  American  Indigenous,  Inter¬ 
national  Ethnic 

Refers  to  tribes  that  are  international  and  are  often  times  independent  of  the 
government. 

Women 

Gender  identification  of  perpetrator  or  victim  in  criminal  activity. 

Children 

Usually  children  killed  or  injured  during  an  event.  Their  status  as  minors 
means  they  cannot  initiate  government  actions. 

Welfare 

Agency  to  ensure  the  well-being  of  citizens. 

The  filtered  event  texts  for  this  group  of  filters  were  “Sexually  Assault,”  “Physically  Assault,” 
“Defy  Norms,”  “Demand  Humanitarian  Aid,”  “Expel  or  Deport  Individuals,”  and  “Threaten  Non- 
Force.”  These  actions  are  discussed  in  Table  5. 

Table  5:  Filters  on  Event  Types  for  Second  Set  of  Filters 


Event  Text  Filter 

Justification  for  Removal 

Sexually  Assault 

The  stories  examined  were  criminal  in  nature,  and  were  carried  out  by  indi¬ 
viduals. 

Physically  Assault 

Assaults  that  take  place  during  a  crime,  person-on-person  violence. 

Defy  Norms 

Protestors  refusing  to  leave  a  protest  site,  defying  a  blockade,  denouncing 
an  act  such  as  sanctions. 

Demand  Humanitarian  Aid 

Typically  done  in  response  to  either  a  natural  disaster  or  a  blockade. 

Expel  or  Deport  Individuals 

Extradition  of  convicted  criminals,  dissidents,  refugees,  or  war  criminals. 

Threaten  Non-Force 

Threaten  to  sue. 
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After  performing  this  set  of  reductions,  the  number  of  events  data  records  was  significantly  re¬ 
duced.  Table  6  shows  the  reductions  for  kinetic  activity  for  years  2004—2013  after  applying  filter 
2  compared  to  before  applying  it. 

Table  6:  ICEWS  Reductions  from  Second  Filter  Set 


Year 

Post-Filter-1  Kinetic  Events 

Post-Filter-2  Kinetic  Events 

2004 

12,154 

8,098 

2005 

9,776 

5,696 

2006 

12,159 

5,981 

2007 

9,193 

5,810 

2008 

7,417 

4,734 

2009 

6,531 

4,184 

2010 

6,962 

4,628 

2011 

7,416 

4,734 

2012 

8,146 

5,048 

2013 

8,449 

2,164 

2.4.7  Filter  3 

The  third  filter  set  removed  additional  non-state  actors.  These  actors  included  Armed  Rebels, 
Armed  Separatists,  Armed  Extremists,  Combatants,  Militia  Groups,  Guerrillas,  Rebel  Groups,  and 
Religious  Separatists  and  Dissidents.  All  of  these  groups  operate  outside  of  the  support  of  the  na¬ 
tional  government,  much  like  the  groups  in  filter  2;  however,  unlike  the  groups  in  filter  2  these 
groups  tend  to  be  better  armed  and  committed  to  using  violence  to  achieve  their  goals. 

The  event  texts  filtered  in  the  third  filter  group  were  “demand  settling  a  dispute,”  and  “demand 
de-escalation  of  military  engagement.”  These  filters  were  selected  because  they  represent  actions 
taken  to  defuse  a  kinetic  escalation. 

Table  7  shows  the  reduction  rates  for  kinetic  activity  for  years  2004-2013  after  applying  filter  3. 
Table  7:  ICEWS  Reductions  from  Third  Filter  Set 


Year 

Post-Filter-2  Kinetic  Events 

Post-Filter-3  Kinetic  Events 

2004 

8,098 

1,592 

2005 

5,696 

1,673 

2006 

5,981 

1,903 

2007 

5,810 

2,094 

2008 

4,734 

1,469 

2009 

4,184 

1,399 

2010 

4,628 

1,561 

2011 

4,734 

1,726 

2012 

5,048 

1,526 
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Year 

Post-Filter-2  Kinetic  Events 

Post-Filter-3  Kinetic  Events 

2013 

2,164 

1,674 

2.4.8  Processing 

On  completion  of  the  third  set  of  filters,  the  ICEWS  data  was  stripped  down  to  the  source  and  tar¬ 
get  countries.  A  kinetic  pairings  (Actor:  Country  A,  Target:  Country  B)  list  was  formed  for  each 
year.  The  list  was  organized  according  to  the  target  countries.  This  was  done  because  the  Zone-H 
look-ups  would  rely  on  target  country  data.  For  example,  2012  has  376  unique  pairings.  These 
pairings  contain  the  source  and  target  countries  and  the  date  of  the  kinetic  event.  These  fields  are 
used  for  the  search  criteria  and  are  the  basis  of  the  data  found  in  Appendix  D.  In  order  to  facilitate 
the  search  process  the  records  were  initially  grouped  by  target  actors. 

2.4.9  Kinetic  Actors 

The  kinetic  actors  were  examined  as  source  countries  and  target  countries.  For  each  year  the  num¬ 
ber  of  source  country  actors  ranged  from  70-80;  the  target  country  actors  also  shared  the  same 
range.  This  group  of  actors  did  not  statistically  differ  from  the  overall  Hofstede  distribution.  Since 
the  numbers  were  so  close  to  the  total  number  of  countries  that  Hofstede  scored,  group  compari¬ 
sons  against  the  Hofstede  population  showed  no  statistical  difference  between  the  kinetic  source 
actors  and  Hofstede’s  global  population.  Table  8  shows  the  results  of  the  group  comparison. 


Table  8:  Group  Comparison  Between  Kinetic  Actors  and  Hofstede's  Population 


Dimension 

z-score 

p-value 

U  value 

Different? 

PDI 

-0.16 

0.4364 

3448.5 

No 

IVC 

0.67 

0.2514 

3711.5 

No 

M/F 

0.65 

0.2578 

3704.5 

No 

UAI 

-0.56 

0.2877 

3677.0 

No 

LvS 

1.20 

0.1151 

2908.0 

No 

IVR 

-0.58 

0.2810 

2233.0 

No 

A  correlational  analysis  was  performed  using  the  number  of  kinetic  events  as  the  dependent  varia¬ 
ble  and  dimensional  scores  of  the  participating  countries  as  the  independent  variable  and  no  rele¬ 
vant  statistical  correlations  were  found.  Table  9  lists  the  findings  across  the  six  dimensions. 


Table  9:  Correlations  Between  Cultural  Values  and  Number  of  Kinetic  Events 


Dimension 

t-value 

r-value 

N 

DF 

Type 

PDI 

-1.49 

-0.1778 

70 

68 

Weak 

IVC 

1.28 

0.1537 

70 

68 

Weak 

M/F 

1.72 

0.2038 

70 

68 

Weak 

UAI 

-0.51 

-0.0616 

70 

68 

None 

LvS 

0.15 

0.0190 

62 

60 

None 

IVR 

-1.08 

-0.1402 

60 

58 

Weak 
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These  findings  were  not  surprising  since  the  kinetic  actors  comprise  a  large  subset  (70  percent)  of 
Hofstede’s  total  country  population.  This  study  is  designed  to  provide  insight  into  those  kinetic 
actors  that  have  added  cyber  capabilities.  Thus,  the  sameness  between  kinetic  actors  and  Hof¬ 
stede’s  population  is  anticipated.  Should  the  cyber  actors  differ  culturally  from  the  overall  popula¬ 
tion,  this  would  suggest  a  potential  cultural  linkage  to  those  countries  that  have  adopted  the  cyber 
domain.  An  examination  of  the  rate  of  adoption  amongst  the  cyber  actors  might  additionally  be  of 
interest. 


Table  10  contains  the  number  of  kinetic  country  pairs  for  years  2004-2013. 


Table  10:  Kinetic  Pairs  List 


Year 

#  Of  Kinetic  Pairs 

2004 

355 

2005 

354 

2006 

412 

2007 

377 

2008 

354 

2009 

406 

2010 

336 

2011 

372 

2012 

376 

2013 

390 

The  kinetic  pairs  inform  the  cyber  search.  The  kinetic  pairs  consist  of  source  actor,  target  actor, 
and  event  date.  The  cyber  search  relies  on  the  target  actor  of  the  pair.  This  is  because  the  corre¬ 
sponding  cyber  data  identifies  the  target  sites  through  the  top-level  domain  country  code  (TLDcc) 
and  because  the  cyber  data  contains  only  the  name  of  the  hacker  group.  Therefore,  searching  the 
cyber  data  on  the  kinetic  pair  information  requires  additional  steps  to  identify  the  source  identity. 

The  collection  of  cyber  data  takes  place  on  government  and  military  domains  that  are  delegated 
from  the  TLDcc.  An  example  would  be  of  the  country  Argentina.  The  TLDcc  for  Argentina  is 
AR.  The  Zone-H  lookup  would  look  for  *.gov.ar  and  *.mil.ar.  This  was  done  for  each  target 
country  in  the  list  for  the  year,  and  the  results  were  entered  into  a  file  that  matched  the  name  of 
the  country. 

The  data  at  Zone-H  also  lists  the  entity  that  reported  the  attack;  in  most  cases  the  entity  is  the  at¬ 
tacker.  A  look  up  to  the  mirror  site  was  performed,  and  the  site,  in  most  cases,  had  some  infor¬ 
mation  that  made  it  possible  to  discern  the  attacker’s  country.  For  example,  the  country  flag  or  a 
message  identifying  the  country  was  used  as  proof  of  the  country  of  origin.  When  the  information 
was  not  readily  available,  a  search  using  Google  often  times  provided  a  news  event  or  other  data 
that  made  possible  the  ability  to  match  the  attacker  to  the  country,  ff  insufficient  information 
could  be  found  on  the  hacker,  the  record  was  assigned  a  source  country  value  of  “Unknown.”  The 
final  number  of  Zone-H  entries  that  were  evaluated  is  displayed  in  Table  11. 
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Table  1 1:  Zone-H  Data  Reductions 


Year 

Pre-Filtered 
Defacement  Events 

Post-Filtered 

Defacement 

Events 

Attributed 

Unknowns 

2004 

113,699 

1503 

1286 

217 

2005 

132,170 

2005 

1921 

84 

2006 

120,145 

2503 

2394 

109 

2007 

69,550 

1000 

951 

49 

2008 

102,121 

1395 

1334 

61 

2009 

136,696 

2265 

2062 

203 

2010 

161,483 

2507 

2010 

497 

2011 

290,523 

4512 

4401 

111 

2012 

208,795 

2617 

2496 

120 

2013 

158,490 

1429 

1334 

95 

Events  tend  to  cluster.  This  is  true  of  both  kinetic  and  cyber  events.  The  nearest  dates  between 
cyber  and  kinetic  data  events  form  an  event  pair.  Multiple  occurrences  of  the  same  event  pairs  in 
the  same  year  will  be  averaged.  In  this  case,  group  comparisons  will  rely  on  Mann- Whitney  U- 
tests  to  determine  statistical  significance  of  the  cyber  actors  as  they  relate  to  the  overall  Hofstede 
distribution.3  A  discussion  of  the  processing  of  the  actor  group  comparisons  and  evaluation  crite¬ 
ria  is  in  the  data  processing  section  of  this  document. 

2.4.10  Data  Processing 

Four  groups  of  actors  were  examined  in  the  cyber  data  that  was  collected  and  processed  based  on 
the  kinetic  pairs. 

•  source  actors 

•  target  actors 

•  both-ST  actors 

•  unpaired  actors 

Each  actor  group  was  compared  against  the  Hofstede  distribution  of  all  countries  using  the  Mann- 
Whitney  U-test.  This  test  is  a  rank  order  test  used  to  compare  groups  of  non-parametric  data.  The 
median  scores  for  the  control  group  (Hofstede  distribution)  and  the  actor  group  are  compared  and 
the  standard  deviation  off  the  median  value  provides  the  Z-score,  which  allows  for  the  look-up  of 
the  probability  value  (p-value).  A  probability  value  <  0.05  indicates  statistical  significance.  Statis¬ 
tical  significance,  in  this  case,  means  that  the  probability  of  randomly  obtaining  the  results  of  the 
test  group  is  equal  to  the  probability  value.  Thus,  the  5%  (p  =  0.05)  threshold  is  reasonable,  espe¬ 
cially  in  the  realm  of  human  behaviors.  The  10%  threshold  is  acceptable  in  some  areas,  but  will 
only  be  considered  for  further  analysis  in  this  study.  Probability  values  that  are  less  than  1 0%,  but 


3  An  additional  group  comparison  between  the  cyber  actors  and  the  kinetic  group  could  be  added  in  an  extension  of 
the  original  study  here. 
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greater  than  5%  will  be  examined  with  the  partner  set  of  a  different  interval  size — an  explanation 
will  be  rendered  along  with  a  recommendation  to  either  accept  or  reject  the  null  hypothesis. 

The  median  values  for  each  year  were  also  saved,  and  trend  analysis  for  the  actors  was  performed 
for  a  five-year  and  a  10-year  interval.  The  10-year  interval  naturally  provided  the  most  data;  how¬ 
ever,  the  real  increase  in  cyber  activity  occurred  in  the  last  four  years  of  the  collected  data.  The 
trend  analysis  relies  on  the  use  of  the  Spearman  correlation  [Gauthier  2001],  The  Spearman  corre¬ 
lation  will  be  used  for  both  correlation  and  trend  analysis  due  to  the  non-parametric  nature  of  the 
data.  The  Pearson  correlation  is  the  better-known  analysis  tool;  however,  the  Pearson  correlation 
assumes  a  normal  distribution  of  the  data  being  evaluated  [Hollander  2013],  The  data  used  in  this 
study  is  lumped  and  non-parametric;  therefore,  the  selected  tools  are  appropriate. 

Time  interval  analysis,  the  delta  between  cyber  and  kinetic  events,  will  be  examined  within  the 
context  of  overall  median  values  per  year,  and  median  values  for  individual  countries  for  each 
year.  All  correlational  tests  will  be  evaluated  using  Cohen’s  coefficient. 

There  are  several  overall  research  questions  for  this  study.  The  first  set  of  questions  asks, 

1 .  Do  cyber  actors  have  unique  cultural  characteristics? 

2.  Do  statistical  trends  exist  for  cyber  actors? 

3.  “Does  a  relationship  exist  between  culture  and  cyber/kinetic  events?” 

The  existence  or  non-existence  of  this  relationship  will  be  tested  through  hypothesis  testing 
against  participation  or  actors  and  the  time  interval.  The  null  hypothesis  will  be  tested  and 
the  results  will  be  evaluated  against  those  findings. 

Ho:  There  is  no  statistical  relationship  between  culture  and  cyber  actors. 

Hi:  A  statistical  relationship  exists  between  culture  and  cyber  actors. 

H2:  There  are  no  statistical  trends  between  culture  and  cyber  actors. 

H3:  Statistical  trends  exist  between  culture  and  cyber  actors. 

H4:  There  are  no  statistical  correlations  between  culture  and  cyber  kinetic  time  inter¬ 
vals. 

H5:  A  statistical  correlation  exists  between  culture  and  cyber  kinetic  time  intervals. 

The  hypothesis  tests  will  decompose  into  multiple  hypothesis  tests  for  each  of  the  six  cultural  di¬ 
mensions.  When  examining  actors  the  analysis  will  also  decompose  for  each  group  of  actors 
(source,  target,  both-ST,  and  unpaired  actors);  thus,  the  true  number  of  hypothesis  tests  will  be 
conducted  against  48  pairs  (thus  evaluating  96  hypotheses).  Twenty-four  tests  were  mn  for  the 
group  comparisons  across  six  dimensions  for  the  source,  target,  unpaired,  and  both-ST  groups. 
Eighteen  tests  were  run  for  trend  analysis  of  three  groups  (source,  target,  and  unpaired)  across  six 
dimensions.  Finally,  six  tests  were  run  for  time  interval  trend  analysis  of  three  groups  (source,  tar¬ 
get,  and  unpaired). 

2.5  Actor  Characteristics 

Actor  characteristics  were  examined  for  each  individual  year  and  collectively  across  the  1 0-year 
and  five-year  intervals.  Appendix  B  contains  the  raw  findings. 
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2.5.1  Hos,  His:  Source  Actors 


Hoso:  There  is  no  statistical  relationship  between  PDI  and  the  source  cyber  actors. 
Hisi:  A  statistical  relationship  exists  between  PDI  and  the  source  cyber  actors. 

Hos2:  There  is  no  statistical  relationship  between  IVC  and  the  source  cyber  actors. 

H  i  S3 :  A  statistical  relationship  exists  between  IVC  and  the  source  cyber  actors. 

Hos4:  There  is  no  statistical  relationship  between  M/F  and  the  source  cyber  actors. 
Hus:  A  statistical  relationship  exists  between  M/F  and  the  source  cyber  actors. 

Hos6:  There  is  no  statistical  relationship  between  UAI  and  the  source  cyber  actors. 

H  is7:  A  statistical  relationship  exists  between  UAI  and  the  source  cyber  actors. 

Hos8:  There  is  no  statistical  relationship  between  LvS  and  the  source  cyber  actors. 
His9:  A  statistical  relationship  exists  between  LvS  and  the  source  cyber  actors. 

Hosio:  There  is  no  statistical  relationship  between  IVR  and  the  source  cyber  actors. 
Hisii:  A  statistical  relationship  exists  between  IVR  and  the  source  cyber  actors. 

2.5.2  Hot,  Hit:  Target  Actors 

Hoto:  There  is  no  statistical  relationship  between  PDI  and  the  target  cyber  actors. 
Hitt:  A  statistical  relationship  exists  between  PDI  and  the  target  cyber  actors. 

Hot2:  There  is  no  statistical  relationship  between  IVC  and  the  target  cyber  actors. 
Hit3:  A  statistical  relationship  exists  between  IVC  and  the  target  cyber  actors. 

Hot4:  There  is  no  statistical  relationship  between  M/F  and  the  target  cyber  actors. 

H  its:  A  statistical  relationship  exists  between  M/F  and  the  target  cyber  actors. 

Hot6:  There  is  no  statistical  relationship  between  UAI  and  the  target  cyber  actors. 
Hit7:  A  statistical  relationship  exists  between  UAI  and  the  target  cyber  actors. 

Hots:  There  is  no  statistical  relationship  between  LvS  and  the  target  cyber  actors. 

H  it9:  A  statistical  relationship  exists  between  LvS  and  the  target  cyber  actors. 

Hotio:  There  is  no  statistical  relationship  between  IVR  and  the  target  cyber  actors. 

H  lti  i  :  A  statistical  relationship  exists  between  IVR  and  the  target  cyber  actors. 

2.5.3  Hou,  Hiu:  Unpaired  Actors 

Houo:  There  is  no  statistical  relationship  between  PDI  and  the  unpaired  cyber  actors. 
Hiui:  A  statistical  relationship  exists  between  PDI  and  the  unpaired  cyber  actors. 
Hou2:  There  is  no  statistical  relationship  between  IVC  and  the  unpaired  cyber  actors. 
Hiu3:  A  statistical  relationship  exists  between  IVC  and  the  unpaired  cyber  actors. 
Hou4:  There  is  no  statistical  relationship  between  M/F  and  the  unpaired  cyber  actors. 
Hiu5:  A  statistical  relationship  exists  between  M/F  and  the  unpaired  cyber  actors. 
Hou6:  There  is  no  statistical  relationship  between  UAI  and  the  unpaired  cyber  actors. 
HiU7:  A  statistical  relationship  exists  between  UAI  and  the  unpaired  cyber  actors. 
Hons:  There  is  no  statistical  relationship  between  LvS  and  the  unpaired  cyber  actors. 
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H  iu9.  -T  statistical  relationship  exists  between  LvS  and  the  unpaired  cyber  actors. 

Homo:  There  is  no  statistical  relationship  between  IVR  and  the  unpaired  cyber  actors. 
Hiuii:  A  statistical  relationship  exists  between  IVR  and  the  unpaired  cyber  actors. 

2.5.4  Hob,  Hib:  Both-ST  Actors 

Hobo:  There  is  no  statistical  relationship  between  PDI  and  the  both-ST  actors. 

H  ibi.  -T  statistical  relationship  exists  between  PDI  and  the  both-ST  actors. 

Hob2:  There  is  no  statistical  relationship  between  IVC  and  the  both-ST  actors. 

Hib3:  A  statistical  relationship  exists  between  IVC  and  the  both-ST  actors. 

Hob4:  There  is  no  statistical  relationship  between  M/F  and  the  both-ST  actors. 

Hibs:  A  statistical  relationship  exists  between  M/F  and  the  both-ST  actors. 

Hob6:  There  is  no  statistical  relationship  between  UAI  and  the  both-ST  actors. 

Hib7:  A  statistical  relationship  exists  between  UAI  and  the  both-ST  actors. 

Hobs:  There  is  no  statistical  relationship  between  LvS  and  the  both-ST  actors. 

Hib9:  A  statistical  relationship  exists  between  LvS  and  the  both-ST  actors. 

Homo:  There  is  no  statistical  relationship  between  IVR  and  the  both-ST  actors. 

H  ib  1 1  -  -T  statistical  relationship  exists  between  I  \  '  IZ  and  the  both-ST  actors. 

2.6  Actor  Trends 

Behavioral  trends  were  examined  for  each  individual  year  and  collectively  across  the  10-year 
five-year  intervals.  Appendix  C  contains  the  raw  findings  of  the  group  actor  trends. 

2.6.1  H2s,  H3S:  Source  Actors 

H2so:  There  is  no  statistical  correlation  between  PDI  and  the  source  cyber  actors. 

H3si:  A  statistical  correlation  exists  between  PDI  and  the  source  cyber  actors. 

H2s2:  There  is  no  statistical  correlation  between  IVC  and  the  source  cyber  actors. 

H3s3:  A  statistical  correlation  exists  between  IVC  and  the  source  cyber  actors. 

H2s4:  There  is  no  statistical  correlation  between  M/F  and  the  source  cyber  actors. 

H3S5:  A  statistical  correlation  exists  between  M/F  and  the  source  cyber  actors. 

H2s6:  There  is  no  statistical  correlation  between  UAI  and  the  source  cyber  actors. 

H3S7:  A  statistical  correlation  exists  between  UAI  and  the  source  cyber  actors. 

H2s8:  There  is  no  statistical  correlation  between  LvS  and  the  source  cyber  actors. 

H3S9:  A  statistical  correlation  exists  between  LvS  and  the  source  cyber  actors. 

H2sio:  There  is  no  statistical  correlation  between  IVR  and  the  source  cyber  actors. 

H3sii:  A  statistical  correlation  exists  between  IVR  and  the  source  cyber  actors. 

2.6.2  H2t,  H3t:  Target  Actors 

H2to:  There  is  no  statistical  correlation  between  PDI  and  the  target  cyber  actors. 

H3ti:  A  statistical  correlation  exists  between  PDI  and  the  target  cyber  actors. 
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H2t2:  There  is  no  statistical  correlation  between  IVC  and  the  target  cyber  actors. 

H3t3:  A  statistical  correlation  exists  between  IVC  and  the  target  cyber  actors. 

H2t4:  There  is  no  statistical  correlation  between  M/F  and  the  target  cyber  actors. 

H3t5:  A  statistical  correlation  exists  between  M/F  and  the  target  cyber  actors. 

H2t6:  There  is  no  statistical  correlation  between  UAI  and  the  target  cyber  actors. 

H3t7:  A  statistical  correlation  exists  between  UAI  and  the  target  cyber  actors. 

Fhts:  There  is  no  statistical  correlation  between  LvS  and  the  target  cyber  actors. 

H3t9:  A  statistical  correlation  exists  between  LvS  and  the  target  cyber  actors. 

FLtio:  There  is  no  statistical  correlation  between  IVR  and  the  target  cyber  actors. 

Fbtn:  A  statistical  correlation  exists  between  IVR  and  the  target  cyber  actors. 

2.6.3  H2u,  H3U:  Unpaired  Actors 

Fhuo:  There  is  no  statistical  correlation  between  PDI  and  the  unpaired  cyber  actors. 

FLui:  A  statistical  correlation  exists  between  PDI  and  the  unpaired  cyber  actors. 

Fhuo:  There  is  no  statistical  correlation  between  IVC  and  the  unpaired  cyber  actors. 

H3113:  A  statistical  correlation  exists  between  IVC  and  the  unpaired  cyber  actors. 

H2u4:  There  is  no  statistical  correlation  between  M/F  and  the  unpaired  cyber  actors. 

H3u5:  A  statistical  correlation  exists  between  M/F  and  the  unpaired  cyber  actors. 

H2U6:  There  is  no  statistical  correlation  between  UAI  and  the  unpaired  cyber  actors. 

H3117:  A  statistical  correlation  exists  between  UAI  and  the  unpaired  cyber  actors. 

H2U8:  There  is  no  statistical  correlation  between  LvS  and  the  unpaired  cyber  actors. 

H3U9:  A  statistical  correlation  exists  between  LvS  and  the  unpaired  cyber  actors. 

Fhuo:  There  is  no  statistical  correlation  between  IVR  and  the  unpaired  cyber  actors. 

FLui  1 :  A  statistical  correlation  exists  between  IVR  and  the  unpaired  cyber  actors. 

2.7  Cyber-Kinetic  Time  Intervals 

This  set  of  hypotheses  is  designed  to  test  the  existence  of  a  statistical  correlation  to  the  time  inter¬ 
val  between  the  cyber  and  kinetic  events.  Pairs  that  have  more  than  one  interval  per  year  will  have 
the  intervals  averaged  in  order  to  avoid  skewing  the  results.  Mild  correlations  will  be  noted  but 
will  be  scored  the  same  as  no  correlation.  Appendix  C  contains  the  raw  findings. 

2.7.1  H4,  H5:  Cyber-Kinetic  Time  Interval  Tests 

H41:  There  is  no  statistical  correlation  between  PDI  and  the  cyber-kinetic  time  interval. 

H51:  A  statistical  correlation  exists  between  PDI  and  the  cyber-kinetic  time  interval. 

H42:  There  is  no  statistical  correlation  between  IVC  and  the  cyber-kinetic  time  interval. 

H52:  A  statistical  correlation  exists  between  IVC  and  the  cyber-kinetic  time  interval. 

H43:  There  is  no  statistical  correlation  between  M/F  and  the  cyber-kinetic  time  interval. 

H53:  A  statistical  correlation  exists  between  M/F  and  the  cyber-kinetic  time  interval. 

H44:  There  is  no  statistical  correlation  between  UAI  and  the  cyber-kinetic  time  interval. 
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H54:  A  statistical  correlation  exists  between  UAI  and  the  cyber-kinetic  time  interval. 

H45:  There  is  no  statistical  correlation  between  LvS  and  the  cyber-kinetic  time  interval. 

H55:  A  statistical  correlation  exists  between  LvS  and  the  cyber-kinetic  time  interval. 

H46:  There  is  no  statistical  correlation  between  IVR  and  the  cyber-kinetic  time  interval. 

H56:  A  statistical  correlation  exists  between  IVR  and  the  cyber-kinetic  time  interval. 

The  second  and  third  test  sets,  should  sufficient  data  be  collected,  will  rely  on  correlational  analy¬ 
sis,  the  Spearman  correlation  [Hauke  2011].  The  evaluation  criteria  for  this  data  will  be  Cohen’s 
coefficient  that  is  used  to  evaluate  human  behaviors.  The  trend  analysis  will  measure  actor  trends 
and  timing  trends.  This  evaluation  will  be  best  performed  assuming  there  are  sufficient  instances 
of  cyber  and  kinetic  event  pairings.  The  nature  of  the  data  determines  which  tools  will  be  used  for 
evaluation  [Hauke  2011].  The  non-parametric  nature  of  Hofstede’s  data  provides  sufficient  cause 
to  evaluate  the  data  using  non-parametric  data  tools. 

In  some  cases  cyber  events  may  precede  kinetic  events  and  in  other  cases  kinetic  may  precede 
cyber.  Since  the  evaluation  is  measuring  the  interval  the  absolute  value  will  be  used  but  the  direc¬ 
tion  will  be  preserved  and  discussed. 
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3  Findings  and  Discussion 


This  section  contains  all  of  the  findings  for  the  various  hypothesis  tests.  Results  that  are  statisti¬ 
cally  insignificant  are  written  in  black.  Findings  with  a  strong  statistical  significance  are  written  in 
red.  Finally,  findings  with  a  moderate  statistical  significance  are  written  in  blue. 

3.1  Ho,  Hi:  Actor  Characterizations 

The  hypotheses  tested  for  a  statistical  relationship  between  culture  and  cyber  actors.  The  tests 
were  performed  for  four  groups  of  actors  across  six  cultural  dimensions.  The  overall  view  ac¬ 
counted  for  the  1 0-year  and  five-year  findings.  Appendix  B  contains  the  results  of  the  yearly 
breakdown.  Table  12  contains  the  10-year  and  five-year  findings  for  source  actors.  Table  13  con¬ 
tains  the  10-year  and  five-year  findings  for  target  actors,  Table  14  contains  the  10-year  and  five- 
year  findings  for  unpaired  actors,  and  Table  15  contains  the  findings  for  the  four-year  both-ST  ac¬ 
tors.  Due  to  the  relatively  young  nature  of  the  cyber  domain,  10-year  data  and  five-year  data  on 
actors  that  were  active  as  both  source  and  target  actors  in  the  same  year  were  not  sufficient  until 
2010. 

3.1.1  Hos,  His:  Source  Actors 

The  source  actors  were  those  hacker  groups  from  countries  that  claimed  responsibility  for  the  at¬ 
tack.  The  source  actors  were  compared  against  the  general  population  and  the  results  are  listed  be¬ 
low  in  Table  12. 

Table  12:  Cyber  Source  Actors 


Year-Dimension 

Z-  Score 

p-value 

U 

Hypothesis  Recommendation 

10  year  PDI 

1.33 

0.0918 

1521.0 

Consider  both:  H0so,  H0si 

5  year  PDI 

2.20 

0.0139 

1313.5 

Consider  both  H0so,  H0si 

10  year  1  VC 

-0.29 

-0.3859 

1252.0 

Accept  H0S2  Reject  H0s3 

5  year  IVC 

-0.79 

-0.2148 

887.5 

Accept  Null  H0s2,  Reject  H0S3 

1 0  year  M/F 

2.30 

-0.0107 

1682.5 

Reject  H0s4,  Accept  H0S5 

5  year  M/F 

1.94 

0.0262 

1276.0 

Reject  H0so4  Accept  H0S5 

10  year  UAI 

0.55 

0.2912 

1391.5 

Accept  H0s6,  Reject  H0S7 

5  year  UAI 

0.26 

0.3974 

1038.0 

Accept  H0s6,  Reject  H0S3 

1 0  year  LvS 

-0.38 

-0.3520 

1037.5 

Accept  Hoss.  Reject  H0S9 

5  year  LvS 

-0.85 

-0.1977 

736.5 

Accept  H0s8, t  Reject  H0S9 

10  year  IVR 

-1.32 

-0.0934 

814.0 

Accept  Hosioi  Reject  H0sn 

5  year  IVR 

-2.08 

-0.0188 

518.0 

Consider  both  H0sio,  H0sn 
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3.1 .2  Explanation  of  Cyber  Source  Actor  Findings 


Hacker  groups  from  countries  that  initiated  the  defacements  were  from  masculine  societies.  In 
both  the  five-year  and  1 0-year  group  comparisons,  these  findings  were  strong.  The  masculine  so¬ 
cieties  tend  to  deal  aggressively  with  conflict,  typically  by  fighting  [Hofstede  2010].  Of  note, 
masculinity  according  to  Hofstede4  also  has  a  competitive  component  that  confers  on  the  “win¬ 
ner”  the  ability  to  stand  out  as  “the  best.5”  The  defacement  of  government  and  military  websites 
would  not  only  be  a  strong  psychological  statement  against  an  adversary,  but  this  activity  would 
also  be  seen  as  a  show  of  virtual  strength  or  power,  which  also  coincides  with  the  high  PDI  and 
masculine  findings.  In  high  PDI  societies,  a  show  of  loyalty  to  those  in  power  in  the  “in  group”  is 
not  only  considered  acceptable,  a  show  of  loyalty  is  rewarded  through  protection  and  ultimately 
advancement.  The  most  interesting  finding  was  the  representation  of  the  restrained  end  of  the  IVR 
dimension.  The  shift  toward  more  restrained  behavior  could  possibly  suggest  that  this  activity 
may  serve  as  an  acceptable  expressive  outlet  in  an  otherwise  restrained  life. 

Two  dimensions  received  a  recommendation  to  consider  both;  this  is  because  the  first  set  of  val¬ 
ues  was  a  moderate  finding  and  the  second  set  of  findings  was  strong.  In  both  cases  the  second  set 
of  values  was  not  only  strong,  but  probability  values  were  below  2%.  Considering  increased  cyber 
activity  within  the  last  five  years  compared  to  the  first  five  years,  this  decision  is  logical. 

3.1.3  Hot,  Hit:  Target  Actors 

The  target  actors  were  those  countries’  government  and  military  sites  that  had  been  compromised.  The 
target  actors  were  compared  against  the  general  population  and  the  results  are  listed  below  in  Table  13. 

Table  13:  Cyber  Target  Actors 


Year-Dimension 

Z-  Score 

p-value 

U 

Hypothesis  Recommendation 

10  year  PDI 

0.90 

0.1841 

1502.5 

Accept  Hoto,  Reject  H1t1 

5  year  PDI 

0.98 

0.1635 

1409.0 

Accept  Hmo,  Reject  H1t1 

10  year  1  VC 

0.73 

0.2327 

1475.0 

Accept  Hot2,  Reject  H1t3 

5  year  IVC 

0.95 

0.1711 

1405.0 

Accept  Hot2,  Reject  H1t3 

1 0  year  M/F 

2.19 

0.0143 

1722.5 

Reject  How,  Accept  H„5 

5  year  M/F 

1.99 

0.0233 

1572.5 

Reject  Ho, 4,  Accept  H„5 

10  year  UAI 

-0.24 

0.4052 

1309.5 

Accept  Hots,  Reject  H1t7 

5  year  UAI 

-0.69 

-0.2451 

1137.0 

Accept  Hots,  Reject  H1t7 

1 0  year  LvS 

-0.67 

0.2514 

996.5 

Accept  Hots,  Reject  H1t9 

5  year  LvS 

-1.43 

-0.0764 

814.0 

Accept  Hots,  Reject  H1t9 

10  year  IVR 

-1.42 

-0.0778 

765.5 

Accept  Hotto,  Reject  H1t1, 

5  year  IVR 

-0.98 

-0.1635 

713.0 

Accept  H0tio,  Reject  Him 

4  See  http://geert-hofstede.com 

5  Ibid 
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3.1.4  Explanation  of  Target  Actor  Findings 


This  group  of  actors  represents  the  victims  of  the  defacement  activities.  The  most  consistent  com¬ 
mon  cultural  characteristic  was  the  masculine  nature  of  this  group.  Masculine  cultures  are  known 
for  direct  and  aggressive  responses  to  conflict.  The  target  countries  in  this  study  had  already  been 
involved  with  kinetic  conflict,  and  the  kinetic  pairing  informed  the  cyber  search,  so  the  cyber  ac¬ 
tivity  against  those  countries  may  be  viewed  as  an  extension  of  the  kinetic  conflicts  or  controver¬ 
sies. 

An  interesting  finding  showed  target  countries  in  the  five-year  interval  showed  both  strong  PDI 
and  IVR  statistical  significance.  The  high  PDI  scores  of  the  targets  are  suggestive  that  the  source 
actors  are  attempting  to  embarrass  the  leadership  of  the  target  countries.  The  strong  restraint 
showing  suggests  a  possible  cultural  projection  of  “helplessness”  onto  the  target  country  [Hof- 
stede  2010,  p.  291].  Many  of  the  messages  on  the  defaced  sites  remind  the  site  owner  that  the  site 
has  been  “owned,”  a  not  so  subtle  reminder  of  the  helplessness  of  the  site  and  site  owner. 

3.1.5  HOu,  Hlu:  Unpaired  Actors 

The  unpaired  actors  were  hackers  from  countries  not  kinetically  involved  with  the  target  country 
yet;  these  actors  attacked  the  target  country’s  sites.  The  unpaired  actors  were  compared  against 
the  general  population  and  the  results  are  listed  below  in  Table  14. 

Table  14:  Cyber  Unpaired  Actors 


Year-Dimension 

Z-  Score 

p-value 

U 

Hypothesis  Recommendation 

10  year  PDI 

1.64 

0.0505 

2245.0 

Consider  both  H0uo,  H1u1 

5  year  PDI 

2.62 

0.0044 

1914.5 

Consider  both  H0uo,  Hi„i 

10  year  IVC 

-0.37 

-0.3557 

1822.0 

Accept  H0U2,  Reject  H1u3 

5  year  IVC 

-0.57 

-0.2843 

1349.0 

Accept  H0U2,  Reject  H1u3 

1 0  year  M/F 

1.42 

0.0778 

2199.0 

Consider  both  H0U4,  H1u5 

5  year  M/F 

1.81 

0.0351 

1771.5 

Consider  both  H0U4,  H1u5 

1 0  year  UAI 

1.33 

-0.1920 

2138.5 

Accept  H0u6,  Reject  H1u7 

5  year  UAI 

1.01 

0.1562 

1629.5 

Accept  H0u6,  Reject  H1u7 

1 0  year  LvS 

-0.12 

-0.4522 

1449.0 

Accept  H0u8,  Reject  H1u9 

5  year  LvS 

-0.10 

-0.4602 

1077.5 

Accept  H0u8,  Reject  H1u9 

10  year  IVR 

-1.22 

-0.1112 

1147.5 

Consider  both  H0uio,  H1u11 

5  year  IVR 

-2.26 

-0.0119 

690.0 

Consider  both  H0uio,  H1un. 

3.1.6  Explanation  of  the  Unpaired  Actor  Findings 

This  group  of  actors  showed  a  significantly  high  PDI  and  strong  restraint,  much  like  the  source 
actors;  however  this  group,  while  masculine,  showed  weaker  masculine  tendencies  than  did  either 
the  source  or  target  actors.  This  could  suggest  a  need  to  “remind”  the  target  that  they  are  battling 
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the  kinetic  behaviors  in  a  relatively  safer  environment  for  expressing  their  views.  The  five-year 
interval  findings  showed  strong  restraint  scores,  and  high  PDI  finding  along  with  the  high  mascu¬ 
line  scores.  This  coincides  with  the  show  of  strength  and  protection  associated  with  high  PDI,  the 
threatening  behavior  of  masculinity  and  the  desire  to  render  hopeless  the  target  that  associates 
with  low  IVR  scores.  Also  of  note,  these  actors  have  stronger  PDI  and  IVR  findings  indicative  of 
very  repressive  authoritarian  societies.  In  short,  this  group  appears  to  have  slightly  exaggerated 
source  actor  tendencies  with  a  slightly  less  masculine  component.  Perhaps  the  cyber  domain  ap¬ 
peals  to  this  group  over  the  kinetic  domain  because  this  domain  allows  for  aggressive  behavior 
without  the  physical  consequences  associated  with  the  kinetic  domain. 

3.1.7  Both-ST  Actors 

The  both-ST  actors  were  those  countries  that  acted  as  source  actors  against  a  target  site  and  also 
had  government  and  military  sites  compromised.  The  both-ST  actors  were  compared  against  the 
general  population  and  the  results  are  listed  below  in  Table  15. 

Table  15:  Both-ST  Actors 


Year-Dimension 

Z-  Score 

p-value 

U 

Hypothesis  Recommendation 

5  year  PDI 

2.28 

0.0113 

1025.0 

Reject  H0bo,  Accept  H1b1 

5  year  IVC 

-0.24 

-0.4052 

720.0 

Accept  H0b2,  Reject  H1b3 

5  year  M/F 

0.91 

0.1814 

859.5 

Accept  H0b4,  Reject  H1b5 

5  year  UAI 

0.42 

0.3372 

801.5 

Accept  H0b6,  Reject  H1b7 

5  year  LvS 

-1.12 

-0.1314 

514.5 

Accept  H0bs,  Reject  H1b9 

5  year  IVR 

-2.16 

-0.0154 

351.0 

Reject  Hobio,  Accept  H1bn 

3.1.8  Explanation  of  Both-ST  Actors 

These  findings  are  limited  to  a  four-year  view  due  to  the  relatively  recent  adoption  of  the  Internet 
as  a  platform  for  political  action.  This  group  of  actors  can  be  thought  of  as  a  subset  of  the  source 
and  target  countries.  The  two  most  common  characteristics  these  two  groups  share  are  high  PDI 
and  low  IVR. 

The  scores  of  this  group  of  actors  are  interesting  because  as  the  intersection  of  source  and  target 
the  expectation  would  normally  suggest  findings  in  common  areas;  however,  this  group  showed 
stronger  PDI  and  IVR  scores  than  the  source  actors.  The  addition  of  the  target  actors  in  this  group 
would  normally  be  considered  a  moderating  influence  on  these  dimensional  values.  Instead,  the 
opposite  was  found.  This  might  suggest  a  need  to  show  dominance  and,  intolerance  for  opposition 
across  all  domains.  The  stronger  PDI  and  IVR  findings  also  suggest  not  only  a  trend  toward  the 
extreme  ends  of  the  dimensional  poles,  but  also  a  possible  enduring  nature  or  long-tenn  nature  to 
these  findings. 

Of  course  these  findings  resulted  from  a  small  interval,  the  five-year  interval,  so  these  findings 
must  be  taken  in  context.  For  example,  the  moderation  from  the  higher  masculine  findings  of  the 
separated  source  and  target  actors  to  a  less  masculine  value,  may  be  explained  by  the  inclusion  of 
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Russia  (feminine  score  36)  in  this  group.  The  potential  for  change  in  the  M/F  dimension  as  this 
group  of  actors  grows  is  possible. 

3.2  Summary  of  Actor  Group  Test 

The  first  testing  of  actors  was  performed  in  order  to  determine  if  cyber  actors  possessed  unique 
cultural  qualities  that  differ  from  the  general  population  and  the  kinetic  actors.  The  findings 
showed  that  while  kinetic  actors  were  statistically  consistent  with  the  general  population,  the 
cyber  actors  had  unique  cultural  values  that  appeared  regardless  of  the  actor’s  role.  The  most  con¬ 
sistently  significant  cultural  finds  were  with  the  masculine  pole  of  the  M/F  dimension.  The  activ¬ 
ity  on  the  high  PDI  and  the  low  IVR  dimensions,  especially  in  the  five-year  window  is  notewor¬ 
thy,  since  this  suggests  that  the  countries  that  share  these  values  are  not  only  more  inclined  to  use 
cyber  as  platform,  they  also  appear  to  have  no  desire  to  hide  their  activities.  The  desire  to  use  the 
public  forum  of  a  website  appears  surprising  for  restrained  cultures,  but  when  taken  in  context  of 
the  high  PDI  scores  the  results  are  consistent.  Based  on  the  results,  the  overall  null  hypothesis  for 
the  cyber  actors  Ho,  which  posited  that  there  is  no  statistical  relationship  between  cultural  values 
and  cyber  actor  roles,  must  be  rejected  and  the  alternative  hypothesis  Hi  should  be  accepted. 

3.3  H2,  H3:  Actor  Trends 

The  next  analysis  examined  the  trends  of  the  various  actor  countries  (source,  target,  and  unpaired) 
over  the  10-year  and  five-year  interval  in  order  to  determine  if  over  time  a  trend  toward  actor 
characteristics  of  source,  target  and  unpaired  actors  could  be  observed.  The  first  set  of  tests  were 
used  to  determine  the  existence  of  a  relationship  between  culture  and  cyber  actors,  the  second  set 
of  tests  begins  the  task  of  measuring  the  cyber-culture  relationship.  The  correlational  testing  was 
performed  in  order  to  determine  if  trends  existed  with  any  of  the  cultural  dimensions  among  the 
three  groups  of  cyber  actors.  The  year  was  used  as  the  independent  variable  and  the  dependent 
value  was  the  median  score  for  each  dimension  of  each  actor  group  per  year.  The  raw  results  are 
in  Appendix  C.  Tables  16-18  will  display  the  results  of  the  Spearman  correlations  for  years  both 
the  five-year  and  1 0-year  trends. 

3.3.1  H2s,  H3S:  Source  Actor  Trends 

These  actors  were  cyber  actors  to  whom  attacks  were  attributed.  The  results  of  the  source  trend 
actors  are  shown  in  Table  16. 
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Table  16:  Source  Actor  10-  and  5-year  Trends 


Interval  /  Dimension 

r 

t 

Correlation 

Hypothesis 

10-yrPDI 

0.6361 

2.33 

Strong  + 

Reject  H2s0,  Accept  H3si 

5-yr  PDI 

0.8 

n/a 

Strong  + 

Reject  H2s0,  Accept  H3si 

10-yr  IVC 

-0.2188 

-0.63 

Weak  - 

Consider  both  H2S2,  H3s3 

5-yr  IVC 

-0.7 

n/a 

Strong  - 

Consider  both  H2s2,  H3s3 

10-yr  M/F 

0.1281 

0.37 

Weak  + 

Consider  both  H2S4,  H3s5 

5-yr  M/F 

0.7 

n/a 

Strong  + 

Consider  both  H2s4,  H3s5 

10-yr  UAI 

-0.6 

-2.12 

Strong  - 

Reject  H2s6,  Accept  H3s7 

5-yr  UAI 

-0.4 

n/a 

Moderate  + 

Reject  H2s6,  Accept  H3s7 

1 0-yr  LvS 

-0.2614 

-0.77 

Weak  - 

Consider  both  H2s8,  H3s9 

5-yr  LvS 

-0.7 

n/a 

Strong  - 

Consider  both  H2s8,  H3s9 

10-yr  IVR 

-0.5601 

-1.91 

Strong  - 

Consider  both  H2s10,  H3s11 

5-yr  IVR 

0.8721 

n/a 

Strong  + 

Consider  both  H2si0,  H3sh 

3.3.2  Explanation  of  Source  Actor  Trend  Findings 

PDI  showed  strong  results  for  both  the  five-year  and  1 0-year  trend.  Over  the  1 0-year  trend  PDI 
scores  of  the  source  country  actors  continued  to  increase;  thus,  the  defacements  are  not  only  fa¬ 
vored  by  high  PDI  countries  but  also  the  higher  the  country’s  PDI  score  the  more  likely  the  coun¬ 
try  will  engage  in  the  activity.  The  finding  of  low  UAI  correlating  over  time  indicates  that  the  de¬ 
facement  countries  are  not  uncomfortable  with  attribution  since  the  situation  that  prompts  the 
action  may  also  justify  the  cyber  act.  The  remainder  of  the  dimensions  required  consideration  of 
both  hypotheses  (null  and  alternative)  and  they  will  be  individually  addressed. 

•  IVC  showed  both  a  weak  and  strong  negative  correlation.  The  general  trend  toward  collectiv¬ 
ism  is  relevant — not  a  single  score  indicated  individualism;  however,  the  fluctuation  of  values 
made  the  trend  weak  even  if  the  behavioral  correlation  appears  strong.  Recommend:  Reject 
null  hypothesis. 

•  M/F  showed  a  weak  and  strong  positive  correlation.  Overall  the  movement  of  scores  is  very 
small  and  does  not  warrant  rejection  of  the  null  hypothesis.  Recommend:  Accept  null  hy¬ 
pothesis. 

•  LvS  appears  to  have,  at  best,  a  weak  trend  toward  short-term  orientation.  Scores  over  a  vari¬ 
ety  of  values  would  suggest  short-term  orientation.  However,  when  the  outlier  score  is  re¬ 
moved  from  the  1 0-year  pairs  the  r- value  drops  dramatically  to  the  point  of  no  correlation. 

Recommend:  Accept  null  hypothesis. 

•  IVR  showed  a  directional  change  from  a  strong  negative  correlation  in  the  1 0-year  set  to  a 
strong  positive  correlation  in  the  five-year  interval.  While  one  of  the  scores  was  strongly  on 
the  low  end  of  the  indulgence  pole,  the  rest  were  relatively  low.  Additional,  analysis  and  test¬ 
ing  would  likely  resolve  this,  and  when  taken  with  other  findings  source  actors  and  restraint 
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appear  to  go  together.  Quite  possibly  at  this  point  in  time  the  five-year  score  is  a  “blip.”  Rec¬ 
ommend:  Inconclusive. 

3.3.3  H2t,  H3t:  Target  Actor  Trends 

These  actors  were  nations  that  were  successfully  targeted.  The  results  of  the  target  or  victim  trend 
actors  are  shown  in  Table  17. 

Table  1 7:  Target  Actor  1 0-  and  5-year  Trends 


Interval  /  Dimension 

r 

t 

Correlation 

Hypothesis 

10-yr  PDI 

0.2918 

0.86 

Weak  + 

Consider  Hao,  H3ti 

5-yr  PDI 

0.3 

n/a 

Moderate  + 

Consider  H2to,  H3M 

10-yr  IVC 

-0.25 

-0.73 

Weak  - 

Accept  H2t2,  Reject  H3t3 

5-yr  IVC 

0.1 

n/a 

None 

Accept  H2t2,  Reject  H3t3 

1 0-yr  M/F 

-0.3643 

-1.11 

Moderate  - 

Consider  both  H2t4,  H3t5 

5-yr  M/F 

-0.1 

n/a 

None 

Consider  both  H2t4,  H3t5 

10-yr  UAI 

0.2683 

0.79 

Weak  + 

Accept  H2t6,  H3,7 

5-yr  UAI 

0.1 

n/a 

None 

Accept  H2t6,  H3t7 

1 0-yr  LvS 

-0.6322 

-2.31 

Strong  - 

Reject  H2t8,  Accept  H2t9 

5-yr  LvS 

-0.7 

n/a 

Strong  - 

Reject  H2t8,  Accept  H2t9 

10-yr  IVR 

-0.5495 

-1.86 

Strong  - 

Consider  both  H2ti0,  H2tn 

5-yr  IVR 

-0.2 

n/a 

None 

Consider  both  H2ti0,  H2t11 

3.3.4  Explanation  of  Target  Actor  Trend  Findings 

The  target  set  of  actors  appeared  to  have  short-term  orientation  (STO)  in  common,  suggesting  a 
possible  casual  approach  to  securing  systems.  One  possible  explanation  may  be  that  in  a  STO  so¬ 
ciety,  a  system  may  be  considered  easily  replaceable;  thus  securing  the  system  may  have  a  low 
priority.  Statistically  speaking  this  group  most  closely  resembles  the  general  population.  Three  di¬ 
mensions  that  warranted  further  examination  were  PDI,  M/F,  and  IVR. 

•  The  weak  and  barely  moderate  findings  of  the  PDI  dimension  lead  to  the  recommendation  of 
acceptance  of  the  null  hypothesis.  Recommend:  acceptance  of  null  hypothesis. 

•  The  M/F  trend  downward  in  the  five-year  interval  is  accompanied  by  a  1 0-year  trend  toward  a 
negative  correlation.  A  quick  inspection  of  the  set  shows  the  downward  trend  along  with  the 
top  half  of  the  pole,  so  that  even  though  the  trend  would  appear  to  move  toward  feminine,  the 
entire  set  of  values  are  masculine.  This  finding  is  noteworthy  since  an  attack  on  a  masculine 
country  would  have  a  good  chance  of  being  followed-up  with  a  response.  Recommend:  re¬ 
jection  of  null  hypothesis. 

•  The  IVR  dimension  showed  a  strong  negative  correlation  on  the  1 0-year  interval  and  a  weak 
negative  correlation  on  the  five-year  interval.  The  general  trend  is  toward  the  restrained  end 
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of  the  pole.  The  most  recent  scores  support  the  downward  trend.  Recommend:  inconclusive 
finding. 

3.3.5  H2u,  H3U:  Unpaired  Actor  Trends 

These  actors  were  attributed  cyber  actors  who  had  no  kinetic  relationship  with  the  target.  The  re¬ 
sults  of  the  unpaired  trend  actors  are  shown  in  Table  18. 

Table  18:  Unpaired  Actor  5-  and  10-Year  Trends 


Interval  /  Dimension 

r 

t 

Correlation 

Hypothesis 

10-yr  PDI 

0.4939 

1.61 

Moderate  + 

Consider  both  H2u0,  H3u1 

5-yr  PDI 

0.9 

n/a 

Strong  + 

Consider  both  H2u0,  H3ui 

10-yr  IVC 

-0.3399 

-1.02 

Moderate  - 

Consider  both  H2u2,  H3u3 

5-yr  IVC 

-0.2 

n/a 

Weak  - 

Consider  both  H2u2,  H3u3 

1 0-yr  M/F 

-0.1581 

-0.45 

None 

Consider  both  H2u4,  H3u5 

5-yr  M/F 

-0.7 

n/a 

Strong  - 

Consider  both  H2u4,  H3u5 

10-yr  UAI 

-0.5416 

-1.82 

Strong  - 

Reject  H2u6,  Accept  H3u7 

5-yr  UAI 

0.8 

n/a 

Strong  + 

Reject  H2u6,  Accept  H3u7 

1 0-yr  LvS 

0.3952 

1.22 

Moderate  - 

Reject  H2u8,  Accept  H3u9 

5-yr  LvS 

0.7 

n/a 

Strong  + 

Reject  H2u8,  Accept  H3u9 

10-yr  IVR 

-0.8049 

-3.84 

Strong  - 

Consider  both  H2u10,  H3„n 

5-yr  IVR 

-0.2 

n/a 

Weak  - 

Consider  both  H2u10,  H3u11 

3.3.6  Explanation  of  Unpaired  Actor  Trend  Findings 

Like  the  source  actors  the  unpaired  actors  showed  strong  positive  correlations  over  time  with  high 
PDI  scores.  This  group  as  a  whole  is  high  PDI,  collectivist  and  restrained.  Unique  to  the  unpaired 
actors  is  a  trend  over  time  toward  long-term  orientation.  This  is  in  direct  contrast  to  the  victims 
who  trend  over  time  toward  short-term  orientation.  Among  other  qualities  associated  with  LTO  is 
perseverance. 

•  The  PDI  scores  were  significant  for  both  at  moderate  and  strong,  which  leads  to  a  recommen¬ 
dation  to  reject  the  null  hypothesis  and  accept  the  alternative.  The  moderate  finding  bordered 
the  cut-off  for  the  strong  range,  and  the  strong  finding  was  very  strong.  Recommend:  Reject 
null  hypothesis,  accept  alternative  hypothesis. 

•  The  IVC  scores  were  moderate  and  weak  on  the  collectivist  end  of  the  pole.  All  scores  were 
in  the  collectivist  half  and  overall  the  values  showed  little  to  no  movement.  Recommend:  In¬ 
conclusive  finding. 

•  The  M/F  findings  were  most  accurately  reflected  in  the  1 0-year  value,  which  showed  a  very 
weak  positive  correlation.  Overall  scores  tended  to  cluster  in  the  middle  of  the  distribution 
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and  a  change  in  direction  is  usually  offset  by  a  follow-on  change  in  the  opposite  direction. 
Neither  extreme  is  represented  in  this  dimension.  Recommend:  Accept  null  hypothesis. 

•  An  interesting  finding  showed  that  while  inconclusive,  this  group  in  general  tends  toward 
higher  UAI  values;  this  is  interesting  because  high  UAI  values  associate  with  rigidity  in  be¬ 
havior.  Countries  that  are  high  UAI  tend  to  go  to  a  great  deal  of  effort  to  control  outcomes. 
Recommend:  Inconclusive  finding. 

•  The  IVR  scores  also  showed  a  strong  negative  correlation  on  the  1 0-year  interval,  while  the 
five-year  interval  showed  a  weak  negative  correlation.  The  scores  in  the  five-year  interval  are 
at  the  lowest  third  of  the  distribution;  thus,  there  is  not  much  room  to  go  lower.  Recommend: 
Reject  null,  accept  alternative. 

3.4  Summary  of  Actor  Trends  Test 

All  of  the  examined  actor  groups  trended  toward  high  PDI,  although  target  countries  showed  only 
a  weak  correlation.  The  source  actors  and  the  unpaired  actors  appear  to  have  the  support  of  their 
respective  leadership,  which  could  be  government,  military,  or  other  powerful  sector  of  society. 
When  high  PDI  is  the  norm,  communication  is  indirect  and  a  show  of  “in  group/out  group”  behav¬ 
ior  prevails.  Thus,  concern  for  the  “out  group”  is  minimized,  making  abuse  acceptable,  and  ap¬ 
proved.  All  three  groups  also  showed  a  10-year  trend  toward  restraint.  This  suggests  that  to  re¬ 
strained  cultures  cyber,  as  an  attack  vector,  is  growing  in  popularity.  Restrained  societies  tend  to 
be  less  tolerant  of  behaviors  outside  of  the  cultural  norm. 

Target  actors  were  closest  to  the  general  population  with  one  notable  exception:  short-term  orien¬ 
tation.  The  STO  may  suggest  the  national  leadership  may  view  the  site  as  temporary,  replaceable, 
or  easily  rebuilt.  Target  countries  also  differ  significantly  from  the  two  groups  in  their  masculine 
nature,  while  the  targets  trended  away  from  masculine  values;  they  remained  in  the  masculine  half 
of  the  group.  The  difference  was  most  noticeable  when  comparing  source  and  target  groups  where 
source  actors  were  noticeably  more  feminine  than  the  masculine  targets. 

3.5  H4,  Hs:  Time  Intervals 

The  time  intervals  were  measured  and  compared  against  cultural  scores.  The  time  interval  was 
based  on  the  nearest  cyber  and  kinetic  dates.  This  was  chosen  due  to  the  uncertainty  in  pairing  the 
events.  The  maximum  interval  between  events  was  set  to  30  days.  This  value,  while  not  perfect, 
was  chosen  as  a  baseline;  in  reality  most  events  occurred  within  14  days.  Appendix  E  contains  the 
raw  findings  and  the  breakdowns.  Tests  were  performed  across  all  six  dimensions  for  10-year  and 
five-year  values  in  order  to  test  H4  and  H5.  The  hypothesis  test  set  the  cultural  dimension  as  the 
independent  variable  and  the  time  interval  as  the  dependent  variable. 

3.6  Processing  and  Pairing  Timed  Kinetic  and  Cyber  Events 

The  kinetic  event  dates  were  aligned  against  the  cyber  event  dates.  Cyber  and  kinetic  pairs  were 
evaluated  by  country  pairs  for  each  year.  A  total  of  1,270  events  were  examined  and  186  pairs,  or 
372  entries,  were  matched.  When  multiple  events  between  pairs  occurred  in  a  year,  those  events 
were  averaged.  Table  19  shows  a  breakdown  of  yearly  entries  and  the  number  of  matched  events. 
A  complete  list  of  the  raw  pairings  can  be  found  in  Appendix  E. 
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Table  19:  Cyber-Kinetic  Timed  Event  Pairings  per  Year 


Year 

#Of 

Events 

All  Pairs 

Pairs  Matched 

Events  Matched 
(Pairs) 

Source  Actors 

2004 

82 

9 

6 

15 

4 

2005 

94 

19 

10 

14 

6 

2006 

75 

15 

7 

8 

5 

2007 

85 

12 

8 

10 

5 

2008 

79 

11 

5 

5 

4 

2009 

164 

21 

14 

21 

8 

2010 

135 

18 

7 

19 

5 

2011 

183 

25 

13 

23 

5 

2012 

220 

28 

18 

44 

11 

2013 

232 

32 

14 

28 

7 

Some  countries,  such  as  India,  Turkey,  Brazil,  Iran,  and  Pakistan  had  many  entries.  The  reduction 
of  the  entries  into  averages  per  year  was  done  to  avoid  having  a  small  number  of  countries  dispro¬ 
portionately  influence  the  findings.  This  decision  also  led  to  the  sharp  reduction  in  the  amount  of 
events  to  process  in  the  final  cyber-kinetic  time  intervals.  A  quick  look  at  Table  19  affirms  this 
observation.  The  column  for  all  pairs  reflects  the  initial  search  pairings  that  had  results  for  evalua¬ 
tion.  The  pairs  matched  column  indicates  a  pairing  of  cyber  and  kinetic  dates,  where  a  defacement 
occurred  from  a  source  country  group  against  a  target  country  government  affiliated  website 
within  30  days  of  a  kinetic  event.  Initially  180  distinct  events  were  paired  for  the  cyber-kinetic 
pairings;  however,  certain  pairs  were  more  active  than  others.  India  and  Pakistan  were  very  active 
over  the  course  of  the  time  measurement  period.  The  relatively  small  number  of  source  actors 
supports  this  observation  for  each  year  that  a  small  group  of  countries  are  the  largest  contributors 
to  this  behavior. 

3.6.1  H4t,  H5t:  Average  Country  Time  Trends 

This  grouping  combined  all  of  the  year’s  data  and  can  be  viewed  as  a  meta-view  of  the  activity. 
The  10-year  pairs  were  averaged  for  each  source  country.  The  source  countries  were  sorted  and 
values  were  averaged  per  country.  The  1 80  discrete  events  when  grouped  by  country  and  year  re¬ 
duced  to  59  events  to  analyze.  This  reduction  contains  the  yearly  averages  for  each  of  the  active 
source  actor  pairs.  For  example,  India  had  active  pairings  in  five  of  the  1 0  years.  In  most  cases  In¬ 
dia  had  more  than  one  match  per  year,  so  the  value  was  averaged  per  year.  Each  yearly  average 
was  averaged  into  an  overall  “average  time  interval.”  In  India’s  case,  the  value  of  7.4  is  the  aver¬ 
age  of  2.8,  10.8,  9.0,  8.5,  and  5.7. 

Table  20  contains  the  names  of  the  countries,  number  of  events  per  country,  and  the  average  time 
interval. 
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Table  20:  Overall  Time  Intervals  per  Country 


Country 

Number  Of  Events 

Average  Time  Interval  (Days) 

Albania 

1 

29.0 

Bangladesh 

2 

9.9 

Brazil 

6 

13.2 

Chile 

1 

17.0 

China 

2 

12.3 

Egypt 

1 

6.5 

Greece 

1 

18.0 

India 

5 

7.4 

Indonesia 

7 

9.3 

Iran 

8 

15.2 

Iraq 

1 

4.7 

Italy 

1 

5.0 

Malaysia 

1 

6.0 

Mexico 

2 

11.6 

Pakistan 

6 

10.0 

Saudi  Arabia 

2 

22.5 

Syria 

3 

12.2 

Taiwan 

2 

13.5 

Turkey 

7 

10.6 

Actor  Totals  of  Event  Years 

59 

- 

A  Spearman  correlation  was  run  for  each  dimension — first  for  the  entire  set,  and  a  second  time  for 
the  filtered  set  that  removed  the  single-event  entries.  The  tests  were  run  using  the  rounded  values 
listed  in  Table  20.  The  first  set  of  test  findings  were  inconclusive.  The  suspicion  of  outliers  having 
influenced  the  results  led  to  a  second  set  of  tests  where  single-entry  pairs  were  removed.  The 
seven  single-year  outliers  were  removed,  and  only  the  multi-year  participants  were  processed.  Re¬ 
sults  of  the  second  test  are  shown  in  Table  21. 
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Table  21:  Multi-Event  Culture  Time  Interval  Correlations 


Data  Type/ 
Dimension 

r 

t 

Type 

Hypothesis 

PDI 

0.0459 

0.15 

None  + 

Accept  null 

IVC 

0.1368 

0.44 

None  - 

Accept  null 

M/F 

-0.1366 

-0.44 

None  + 

Accept  null 

UAI 

0.2592 

0.85 

Weak  + 

Accept  null 

LvS 

-0.3357 

-1.13 

Moderate  - 

Reject  null 

IVR 

0.5376 

1.91 

Strong  + 

Reject  null 

3.6.2  Explanation  of  Findings 

The  strongest  correlation  was  between  indulgence  and  length  of  time.  The  strong  positive  correla¬ 
tion  with  IVR  may  be  explained  by  the  tolerance  of  views  and  behaviors  by  high  IVR  countries. 
Thus,  allowing  and  considering  opposing  views  into  the  discussion  may  slow  the  response  time. 
The  negative  correlation  between  LvS  was  an  unanticipated  finding.  One  possible  explanation  for 
this  is  the  LTO  society  is  holistic  in  thinking  and  the  STO  society  is  more  specific;  thus,  the  de¬ 
facement  and  response  may  not  be  considered  a  part  of  the  mission  requiring  immediate  re¬ 
sponses.  The  weak  UAI  finding  is  noteworthy,  since  these  high  UAI  countries  would  likely  con¬ 
sider  various  outcomes  before  acting  in  order  to  guarantee  a  more  certain  outcome.  Over  time  this 
dimension  could  potentially  have  a  stronger  showing.  These  findings  suggest  the  need  for  follow- 
on  research. 

3.6.3  Other  Findings 

When  the  raw  data  was  examined  over  the  1 0-year  interval  both  with  and  without  the  single  entry 
actors,  a  positive  correlation  was  observed  between  IVR  and  the  time  interval.  This  correlation 
was  weak  with  the  entire  dataset  and  moderate  bordering  on  strong  with  the  reduced  dataset.  This 
is  consistent  with  the  findings  of  the  averaged  values  dataset.  Perhaps  one  of  the  more  fascinating 
findings  associated  with  the  IVR  time  interval  positive  correlation  is  the  fact  that  this  dimension, 
more  than  LvS,  consistently  correlated  positively.  This  consistent  finding  of  indulgent  societies 
correlating  positively  with  event  data  time  intervals  makes  this  dimension  the  most  accurate  in  de¬ 
termining  cyber-kinetic  responses.  It  should  be  noted  that  PDI,  while  not  a  determinant  of  activity, 
is  mostly  high;  there  are  no  low  PDI  countries  in  the  cyber-kinetic  pairings.  This  may  be  because 
many  of  the  low  PDI  countries  (Israel,  United  States,  United  Kingdom)  have  moved  onto  other 
attack  vectors  that  were  not  examined  in  this  study. 
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4  Country  Cultural  Profiles 


Each  country  that  engaged  in  web  defacements  as  a  form  of  cyber  activity  was  entered  into  Hof- 
stede’s  website  that  broadly  characterizes  the  country  that  is  entered.  Hofstede  or  the  Country 
Comparison  page  on  the  Geert-Hofstede  website  contains  the  cultural  profiles  of  the  countries 
used  in  the  time  interval  pairings  [Hofstede  2010,  Hofstede  2013]. 

4.1  Summary  of  Findings 

FI.  Source  actors  tend  to  be  high  PDI,  restrained  and  had  masculine 
leanings. 

Support  for  Finding 

Table  12,  derived  from  Appendix  B  data,  provides  the  support  of  the  actor  characterization 
against  the  general  population.  Table  16  derived  from  Appendix  C,  displayed  the  behavioral 
trends  of  source  actors  that  were  consistently  high  in  PDI,  masculine,  and  restrained  values. 

Possible  Implications  and  Discussion 

High  PDI  countries  not  only  require  permission  and  loyalty  of  underlings  to  superiors,  but  belief 
that  “might  makes  right”  provides  cover  and  justification  of  the  attack  [Hofstede  2010].  Masculin¬ 
ity  provides  the  aggression  component  of  the  attack.  The  restraint  trait  suggests  both  intolerance 
for  different  views  and  a  willingness  to  punish  digressions  [Minkov  2013].  All  of  these  combined 
values  provide  a  justification  for  a  strong  response  across  both  cyber  and  kinetic  domains.  The 
positive  correlation  between  high  PDI  values  and  increased  time  between  attacks  fits  with  the 
longer  decision-making  time  associated  with  high  PDI  countries  [Guess  2004]. 

F2.  Target  Countries  tend  to  be  masculine. 

Support  for  Finding 

In  addition  to  the  actor  profile  data  (Table  1 3  and  Appendix  B)  the  trends  data  (Table  1 7  and  Ap¬ 
pendix  C)  also  supports  the  masculine  preference. 

Possible  Implications  and  Discussion 

Masculine  cultures  are  competitive  and  direct,  especially  when  dealing  with  conflict.  This  behav¬ 
ior  may  set  the  target  countries  in  the  path  of  the  source  and  unpaired  countries  that  also  share  the 
direct  confrontational  behaviors. 
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F3.  Unpaired  countries  were  higher  in  PDI  and  more  restrained  than 
source  countries  and  the  masculine  leanings  were  weaker  than  ei¬ 
ther  source  or  target  countries. 

Support  for  Finding 

Table  14,  derived  from  Appendix  B  data,  provides  the  support  of  the  actor  characterization 
against  the  general  population.  Table  18,  derived  from  Appendix  C,  displays  the  behavioral  trends 
of  source  actors  that  were  consistent  with  high  PDI  and  restraint  values. 

Possible  Implications  and  Discussion 

The  stronger  restraint  finding  relates  to  a  strong  sense  of  right  and  wrong  behaviors.  The  mascu¬ 
line  score  suggests  a  need  to  confront  unacceptable  behaviors  in  a  less  confrontational  manner. 

The  defacements  offer  the  opportunity  to  respond  to  unacceptable  behaviors  using  an  aggressive 
tone  while  maintaining  the  distance  of  the  virtual  environment.  Also  of  potential  interest:  re¬ 
strained  societies  encourage  deeper  learning  and  indulgent  societies  encourage  superficial  learning 
[Hofstede  2010].  The  defacement  may  provide  an  opportunity  for  the  attacker  to  show  a  certain 
depth  of  knowledge  while  delivering  a  message  of  disapproval. 

F4.  IVR,  LvS,  and  UAI  showed  the  strongest  statistical  correlations  with 
time  intervals. 

Support  for  Finding 

Table  21  and  Appendix  D  contain  the  data  in  support  of  the  finding.  The  trends  of  the  multi-year 
events  showed  the  correlations  between  the  UAI,  LvS  and  IVR  dimensions.  The  IVR  correlation 
was  strong,  the  LvS  correlation  was  moderate  and  the  UAI  correlation  was  weak. 

Possible  Implications  and  Discussion 

The  positive  correlation  with  IVR  may  be  explained  by  the  tolerance  for  considering  multiple 
analyses  or  viewpoints  that  provide  various  alternative  responses.  These  responses  would  be  fully 
evaluated  before  the  final  action  is  taken.  The  LvS  finding  may  reflect  the  prioritizations  associ¬ 
ated  with  STO  countries  where  the  people  tend  to  think  tactically.  In  short,  the  Webserver  may  not 
be  too  important  in  a  STO  country  during  times  of  conflict.  The  weak  UAI  finding  is  noteworthy, 
due  to  behaviors  associated  with  uncertainty-avoiding  cultures,  such  as  precision  and  single  cor¬ 
rect  answers.  When  the  UAI  behaviors  combine  with  the  accommodating  nature  of  indulgence, 
the  delayed  response  time  may  reflect  views  that  value  effective  responses  over  timely  responses. 

F5.  IVR  appeared  to  be  the  greatest  predictor  of  behaviors. 

Support  for  Finding 

Appendix  B,  C,  and  D,  along  with  tables  12-21,  shows  the  findings  involving  the  IVR  dimension. 

Possible  Implications  and  Discussion 

The  IVR  dimension  showed  activity  and  the  consistent  movement  toward  a  lower  value  (more  re¬ 
strained)  is  noteworthy.  Even  more  interesting  is  the  distribution  of  the  IVR  general  population 
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data,  which  is  non-parametric,  with  the  most  common  values  in  the  mid-range.  While  the  source 
actors  were  in  the  low  end  of  the  mode  the  unpaired  scores  were  well  below  the  mode  grouping. 
This  suggests  that  restrained  cultures  along  with  their  high  PDI  brethren  are  the  most  active  and 
can  be  counted  on  to  respond  to  a  slight  (real  or  perceived)  using  both  cyber  and  kinetic  re¬ 
sponses. 
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5  Conclusions  and  Recommendations 


Differences  were  observed  between  different  types  of  cyber  actors  and  between  cyber  and  kinetic 
actors.  The  kinetic  group  and  the  targets  most  closely  matched  the  general  population,  and  the 
source  actors  and  unpaired  actors  most  closely  matched  each  other.  The  prevalence  of  restrained 
cultures  in  so  many  areas  was  an  unanticipated  finding. 

The  data  used  for  the  study  has  the  potential  for  re-use  in  other  studies  that  can  provide  greater  in¬ 
sight  into  both  cyber  and  kinetic  events.  The  ability  to  expand  the  study  to  examine  frequencies, 
attack  vectors,  additional  attack  data,  along  with  the  nature  of  the  attacks  provides  opportunities 
for  likely  follow-on  studies.  This  research  direction  may  proceed  to  increase  breadth  and  depth  of 
understanding. 

There  were  many  different  facets  to  this  study  and  each  area  represents  just  the  first  findings 
based  on  this  initial  research.  Furthermore,  this  research  has  cross-discipline  aspects  for  which 
foundational  research  is  limited.  This  study  provides  many  launching  points  for  building  a  signifi¬ 
cant  body  of  knowledge  in  the  area  of  combining  behavioral  science  with  cybersecurity.  Because 
this  research  is  foundational  in  nature,  the  tools  used  to  evaluate  were  inferential  statistical  tools. 
As  such,  correlations  or  inferences  could  be  drawn,  but  this  is  not  synonymous  with  causation. 

Also,  the  findings  in  this  study  are  limited  in  scope  and  this  should  be  considered  when  abstract¬ 
ing  the  findings.  There  is  a  trade-off  between  using  ground  truth  data  and  less  reliable  but  more 
variable  sources  that  may  provide  other  attack  vectors.  However,  the  ability  to  accurately  attribute 
the  variable  data  sources  would  inaccurately  skew  the  findings.  Thus  a  logical  next  step  would  in¬ 
volve  collecting  ground  truth  data  on  another  attack  vector  such  as  malware  or  DoS/DDoS  attacks 
and  performing  a  similar  analysis. 
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Appendix  A:  Hofstede  Data 


This  appendix  contains  the  Hofstede  spreadsheet  obtained  from  his  website 
http://www.geerthofstede.eu/dimension-data-matrix. 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Albania 

90 

20 

80 

70 

61 

15 

Angola 

83 

18 

20 

60 

15 

83 

Argentina 

49 

46 

56 

86 

20 

62 

Australia 

36 

90 

61 

51 

21 

71 

Austria 

11 

55 

70 

70 

60 

63 

Bangladesh 

80 

20 

55 

60 

47 

20 

Belgium 

65 

75 

54 

94 

82 

57 

Bhutan 

94 

52 

32 

28 

Null 

Null 

Brazil 

69 

38 

49 

76 

44 

59 

Bulgaria 

70 

30 

40 

85 

69 

16 

Burkina  Faso 

70 

15 

50 

55 

27 

18 

Canada 

38 

80 

52 

48 

36 

68 

Cape  Verde 

75 

20 

15 

40 

12 

83 

Chile 

63 

23 

28 

86 

31 

68 

China 

80 

20 

66 

30 

87 

24 

Columbia 

67 

13 

64 

80 

13 

83 

Costa  Rica 

35 

15 

21 

86 

Null 

Null 

Croatia 

73 

33 

40 

80 

58 

33 

Czech  Rep. 

57 

58 

57 

74 

70 

29 

Denmark 

18 

74 

16 

23 

25 

70 

Dominican 

Republic 

65 

30 

65 

45 

13 

54 

Ecuador 

78 

8 

63 

67 

Null 

Null 

Egypt 

70 

25 

45 

80 

7 

4 

El  Salvador 

66 

19 

40 

94 

20 

89 

Estonia 

40 

60 

30 

60 

82 

16 

Ethiopia 

70 

20 

65 

55 

Null 

Null 

Fiji 

78 

14 

46 

48 

Null 

Null 

Finland 

33 

63 

26 

59 

38 

57 

France 

68 

71 

43 

86 

63 

48 

Germany 

35 

67 

66 

65 

83 

40 

Ghana 

80 

15 

40 

65 

4 

72 

Greece 

60 

35 

57 

100 

45 

50 

Guatemala 

95 

63 

37 

99 

Null 

Null 

Honduras 

80 

20 

40 

50 

Null 

Null 

Hong  Kong 

68 

25 

57 

29 

61 

17 

Hungary 

46 

80 

88 

82 

58 

31 

Iceland 

30 

60 

10 

50 

28 

67 

India 

77 

48 

56 

40 

51 

26 

Indonesia 

78 

14 

46 

48 

62 

38 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Ireland 

28 

70 

68 

35 

24 

65 
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Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Israel 

13 

54 

47 

81 

38 

Null 

Italy 

50 

76 

70 

75 

61 

30 

Jamaica 

45 

39 

68 

14 

Null 

Null 

Japan 

54 

45 

95 

92 

88 

42 

Jordan 

70 

30 

45 

65 

16 

43 

Kenya 

70 

25 

60 

50 

Null 

Null 

Kuwait 

90 

25 

40 

80 

Null 

Null 

Latvia 

44 

70 

9 

63 

69 

13 

Lebanon 

75 

40 

65 

50 

14 

25 

Libya 

80 

38 

52 

68 

23 

34 

Lithuania 

42 

60 

19 

65 

82 

16 

Luxembourg 

40 

60 

50 

70 

64 

56 

Malawi 

70 

30 

40 

50 

Null 

Null 

Malaysia 

100 

26 

50 

36 

41 

57 

Mexico 

81 

30 

69 

82 

24 

97 

Morocco 

70 

46 

53 

68 

14 

25 

Mozambique 

85 

15 

38 

44 

11 

80 

Namibia 

65 

30 

40 

45 

35 

Null 

Nepal 

65 

30 

40 

40 

Null 

Null 

Netherlands 

38 

80 

14 

53 

67 

68 

New  Zealand 

22 

79 

58 

49 

33 

75 

Nigeria 

80 

30 

60 

55 

13 

84 

Norway 

31 

69 

8 

50 

35 

55 

Pakistan 

55 

14 

50 

70 

50 

0 

Panama 

95 

11 

44 

86 

Null 

Null 

Peru 

64 

16 

42 

87 

25 

46 

Philippines 

94 

32 

64 

44 

27 

42 

Poland 

68 

60 

64 

93 

38 

29 

Portugal 

63 

27 

31 

99 

28 

83 

Romania 

90 

30 

42 

90 

52 

20 

Russia 

93 

39 

36 

95 

81 

20 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

Senegal 

70 

25 

45 

55 

24 

Null 

Serbia 

86 

25 

43 

92 

52 

28 

Sierra  Leone 

70 

20 

40 

50 

Null 

Null 

Singapore 

74 

20 

48 

8 

72 

46 

Slovakia 

100 

52 

100 

51 

77 

28 

Slovenia 

71 

27 

19 

88 

49 

48 

South  Africa 

49 

65 

63 

49 

34 

63 

South  Korea 

60 

18 

39 

85 

100 

29 

Spain 

57 

51 

42 

86 

48 

44 

Sri  Lanka 

80 

35 

10 

45 

45 

Null 

Suriname 

85 

47 

37 

92 

Null 

Null 

Sweden 

31 

71 

5 

29 

53 

78 

Switzerland 

34 

68 

70 

58 

74 

78 

Syria 

80 

35 

52 

60 

30 

Null 

Taiwan 

58 

17 

45 

69 

93 

49 

Tanzania 

70 

25 

40 

50 

34 

38 

Thailand 

64 

20 

34 

64 

32 

45 

Trinidad  &  Tobago 

47 

16 

58 

55 

13 

80 
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Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Turkey 

66 

37 

45 

85 

49 

49 

UAE 

90 

25 

50 

80 

Null 

Null 

UK 

35 

89 

66 

35 

51 

69 

USA 

40 

91 

62 

46 

26 

68 

Uruguay 

61 

36 

38 

99 

26 

53 

Venezuela 

81 

12 

73 

76 

16 

100 

Vietnam 

70 

20 

40 

30 

57 

35 

Zambia 

60 

35 

40 

50 

30 

42 
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Appendix  B:  Data  for  Statistical  Relationship  Between  Culture 
and  Cyber  Actors 


This  appendix  includes  the  data  for  the  hypothesis  tests  for  a  statistical  relationship  between  cul¬ 
ture  and  cyber  actors.  The  tests  were  performed  for  four  groups  of  actors  (source  actors,  target  ac¬ 
tors,  unpaired  actors,  and  “both-ST”  source/target  actors)  across  six  cultural  dimensions.  The 
overall  view  accounted  for  the  1 0-year  and  five-year  findings.  Due  to  the  relatively  young  nature 
of  the  cyber  domain,  1 0-year  data  and  five-year  data  on  actors  that  were  active  as  both-ST  actors 
in  the  same  year  were  not  sufficient  until  2010. 

Results  that  are  statistically  insignificant  are  written  in  black.  Findings  with  a  strong  statistical 
significance  are  written  in  red.  Finally  findings  with  a  moderate  statistical  significance  are  written 
in  blue. 

Source  Actors:  Ten  years 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Albania 

90 

20 

80 

70 

61 

15 

Argentina 

49 

46 

56 

86 

20 

62 

Bangladesh 

80 

20 

55 

60 

47 

20 

Brazil 

69 

38 

49 

76 

44 

59 

Chile 

63 

23 

28 

86 

31 

68 

China 

80 

20 

66 

30 

87 

24 

Egypt 

70 

25 

45 

80 

7 

4 

Germany 

35 

67 

66 

65 

83 

40 

Greece 

60 

35 

57 

100 

45 

50 

India 

77 

48 

56 

40 

51 

26 

Indonesia 

78 

14 

46 

48 

62 

38 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Italy 

50 

76 

70 

75 

61 

30 

Jordan 

70 

30 

45 

65 

16 

43 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Mexico 

81 

30 

69 

82 

24 

97 

Morocco 

70 

46 

53 

68 

14 

25 

Pakistan 

55 

14 

50 

70 

50 

0 

Philippines 

94 

32 

64 

44 

27 

42 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

Syria 

80 

35 

52 

60 

30 

null 

Taiwan 

58 

17 

45 

69 

93 

49 
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Turkey 

66 

37 

45 

85 

49 

49 

United  States 

40 

91 

62 

46 

26 

68 

1 0-year 

z  =1.33 

z  =  -0.29 

z  =  2.30 

z  =  0.55 

z  =  -0.38 

z  =  -1 .32 

p  =0.0918 

p  =  -0.3859 

p  = -0.0107 

p  =  0.2912 

p  =  -0.3520 

p  =-0.0934 

u  =  1521.0 

u  =  1252.0 

u  =  1682.5 

u  =  1391.5 

u  =  1037.0 

u  =  814.0 
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Source  Actors:  Five  years 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Albania 

90 

20 

80 

70 

61 

15 

Argentina 

49 

46 

56 

86 

20 

62 

Bangladesh 

80 

20 

55 

60 

47 

20 

Brazil 

69 

38 

49 

76 

44 

59 

China 

80 

20 

66 

30 

87 

24 

Egypt 

70 

25 

45 

80 

7 

4 

Greece 

60 

35 

57 

100 

45 

50 

India 

77 

48 

56 

40 

51 

26 

Indonesia 

78 

14 

46 

48 

62 

38 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Jordan 

70 

30 

45 

65 

16 

43 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Morocco 

70 

46 

53 

68 

14 

25 

Pakistan 

55 

14 

50 

70 

50 

0 

Philippines 

94 

32 

64 

44 

27 

42 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

Syria 

80 

35 

52 

60 

30 

Null 

Turkey 

66 

37 

45 

85 

49 

49 

5-year 

z  =  2.20 

z=  -0.79 

z=  1.94 

z  =  0.26 

z  =  -0.85 

z  =  -2.08 

p  = -0.0139 

p  = -0.2148 

p  =  0.0262 

p  =  0.3974 

p  = -0.1977 

p  =  -0.0188 

u  =  1313.5 

u  =  887.5 

u  =1276.0 

u  =  1038.0 

u  =  736.5 

u  =  518.0 
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Target  Actors:  Ten  years 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Albania 

90 

20 

80 

70 

61 

15 

Argentina 

49 

46 

56 

86 

20 

62 

Australia 

36 

90 

61 

51 

21 

71 

Bangladesh 

80 

20 

55 

60 

47 

20 

Brazil 

69 

38 

49 

76 

44 

59 

China 

80 

20 

66 

30 

87 

24 

Egypt 

70 

25 

45 

80 

7 

4 

India 

77 

48 

56 

40 

51 

26 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Israel 

13 

54 

47 

81 

38 

Null 

Jordan 

70 

30 

45 

65 

16 

43 

Lebanon 

75 

40 

65 

50 

14 

25 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Nepal 

65 

30 

40 

40 

Null 

Null 

Pakistan 

55 

14 

50 

70 

50 

0 

Philippines 

94 

32 

64 

44 

27 

42 

Poland 

68 

60 

64 

93 

38 

29 

Russian  Federation 

93 

39 

36 

95 

81 

20 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

South  Africa 

49 

65 

63 

49 

34 

63 

Syria 

80 

35 

52 

60 

30 

Null 

Taiwan 

58 

17 

45 

69 

93 

49 

Turkey 

66 

37 

45 

85 

49 

49 

United  Kingdom 

35 

89 

66 

35 

51 

69 

United  States 

40 

91 

62 

46 

26 

68 

1 0-year 

z  =  0.90 

z  =  0.73 

z  =  2.19 

z  =  -0.24 

z=  -0.67 

z  =  -1.42 

p  =  0.1841 

p  =  0.2327 

p  = -0.0143 

p  =  0.4052 

p  =  0.2514 

p  =  -0.0778 

u  =  1502.5 

u  =  1475.0 

u  =  1722.5 

u  =  1309.5 

u  =  996.5 

u  =  765.5 
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Target  Actors:  Five  years 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Argentina 

49 

46 

56 

86 

20 

62 

Australia 

36 

90 

61 

51 

21 

71 

Bangladesh 

80 

20 

55 

60 

47 

20 

Brazil 

69 

38 

49 

76 

44 

59 

China 

80 

20 

66 

30 

87 

24 

Egypt 

70 

25 

45 

80 

7 

4 

India 

77 

48 

56 

40 

51 

26 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Israel 

13 

54 

47 

81 

38 

null 

Jordan 

70 

30 

45 

65 

16 

43 

Lebanon 

75 

40 

65 

50 

14 

25 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Nepal 

65 

30 

40 

40 

null 

null 

Nigeria 

80 

30 

60 

55 

13 

84 

Pakistan 

55 

14 

50 

70 

50 

0 

Philippines 

94 

32 

64 

44 

27 

42 

Russian  Federation 

93 

39 

36 

95 

81 

20 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

South  Africa 

49 

65 

63 

49 

34 

63 

Syria 

80 

35 

52 

60 

30 

null 

Turkey 

66 

37 

45 

85 

49 

49 

United  Kingdom 

35 

89 

66 

35 

51 

69 

United  States 

40 

91 

62 

46 

26 

68 

5  year 

z  =  0.98 

z  =  0.95 

z  =  1.99 

z  =  -0.69 

z  =  -1 .43 

z=  -0.98 

p  =  0.1635 

p  =  0.1 71 1 

p  =  0.0233 

p  =  -0.2451 

p  =  -0.0764 

p  = -0.1635 

u  =  1409.0 

u  =  1405.0 

u  =  1572.5 

u  =  1137.0 

u=  814.0 

u  =  713.0 
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Unpaired  Actors:  Ten  years 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Albania 

90 

20 

80 

70 

61 

15 

Argentina 

49 

46 

56 

86 

20 

62 

Bangladesh 

80 

20 

55 

60 

47 

20 

Belgium 

65 

75 

54 

94 

82 

57 

Brazil 

69 

38 

49 

76 

44 

59 

Bulgaria 

70 

30 

40 

85 

69 

16 

Chile 

63 

23 

28 

86 

31 

68 

China 

80 

20 

66 

30 

87 

24 

Denmark 

18 

74 

16 

23 

35 

70 

Ecuador 

78 

8 

63 

67 

Null 

Null 

Egypt 

70 

25 

45 

80 

7 

4 

Germany 

35 

67 

66 

65 

83 

40 

India 

77 

48 

56 

40 

51 

26 

Indonesia 

78 

14 

46 

48 

62 

38 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Italy 

50 

76 

70 

75 

61 

30 

Jordan 

70 

30 

45 

65 

16 

43 

Kuwait 

90 

25 

40 

80 

Null 

Null 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Mexico 

81 

30 

69 

82 

24 

97 

Morocco 

70 

46 

53 

68 

14 

25 

Pakistan 

55 

14 

50 

70 

50 

0 

Peru 

64 

16 

42 

87 

25 

46 

Philippines 

94 

32 

64 

44 

27 

42 

Portugal 

63 

27 

31 

99 

28 

33 

Russia 

93 

39 

36 

95 

81 

20 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

Serbia 

86 

25 

43 

92 

52 

28 

Spain 

57 

51 

42 

86 

48 

44 

Syria 

80 

35 

52 

60 

30 

Null 

Turkey 

66 

37 

45 

85 

49 

49 

UAE 

90 

25 

50 

80 

Null 

Null 

UK 

35 

89 

66 

35 

51 

69 

US 

40 

91 

62 

46 

26 

68 

Venezuela 

81 

12 

73 

76 

16 

100 

Vietnam 

70 

20 

40 

30 

57 

35 
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z=  1.64 

z  =  -0.37 

z  =  1.42 

z=  1.33 

z  =  -0.12 

z  =  -1.22 

p  =  0.0505 

p  =  -0.3557 

p  =  0.0778 

p  = -0.1920 

p  =  -0.4522 

p  =  -0.1112 

u=  2245.0 

u  =  1822.0 

u  =  2199.0 

u  =  2138.5 

u  =  1449.0 

u  =  1147.5 

Unpaired  Actors:  Five  years 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Albania 

90 

20 

80 

70 

61 

15 

Argentina 

49 

46 

56 

86 

20 

62 

Bangladesh 

80 

20 

55 

60 

47 

20 

Brazil 

69 

38 

49 

76 

44 

59 

Bulgaria 

70 

30 

40 

85 

69 

16 

China 

80 

20 

66 

30 

87 

24 

Ecuador 

78 

8 

63 

67 

Null 

Null 

Egypt 

70 

25 

45 

80 

7 

4 

India 

77 

48 

56 

40 

51 

26 

Indonesia 

78 

14 

46 

48 

62 

38 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Italy 

50 

76 

70 

75 

61 

30 

Jordan 

70 

30 

45 

65 

16 

43 

Kuwait 

90 

25 

40 

80 

Null 

Null 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Mexico 

81 

30 

69 

82 

24 

97 

Morocco 

70 

46 

53 

68 

14 

25 

Pakistan 

55 

14 

50 

70 

50 

0 

Philippines 

94 

32 

64 

44 

27 

42 

Russia 

93 

39 

36 

95 

81 

20 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

Serbia 

86 

25 

43 

92 

52 

28 

Spain 

57 

51 

42 

86 

48 

44 

Syria 

80 

35 

52 

60 

30 

Null 

Turkey 

66 

37 

45 

85 

49 

49 

UAE 

90 

25 

50 

80 

Null 

Null 

UK 

35 

89 

66 

35 

51 

69 

z  =  2.62 

z  =  -0.57 

z  =  1.81 

z  =  1.01 

z  =  -0.10 

z  =  -2.26 

p  =  0.0044 

p  =  -0.2843 

p  =  0.0351 

p  =0.1562 

p  =  -0.4602 

p  = -0.0119 

u  =  1914.5 

u  =  1349.0 

u  =  1771.5 

u  =1629.5 

u  =  1077.5 

u  =  690.0 
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Both-ST  Actors 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Bangladesh 

80 

20 

50 

50 

47 

20 

Brazil 

69 

38 

49 

76 

44 

59 

Egypt 

70 

25 

45 

80 

7 

4 

India 

77 

48 

56 

40 

51 

26 

Iran 

58 

41 

43 

59 

14 

40 

Iraq 

95 

30 

70 

85 

25 

17 

Jordan 

70 

30 

45 

65 

16 

43 

Lebanon 

75 

40 

65 

50 

14 

25 

Libya 

80 

38 

52 

68 

23 

34 

Malaysia 

100 

26 

50 

36 

41 

57 

Pakistan 

55 

14 

50 

70 

50 

0 

Russian  Federation 

93 

39 

36 

95 

81 

20 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

Syria 

80 

35 

52 

60 

30 

Null 

Turkey 

66 

37 

45 

85 

49 

49 

z  =  2.28 

z  =  -0.24 

z  =  0.91 

z  =  0.42 

z  =  -1.12 

z  =  -2.16 

p  =  0.0113 

p  =  -0.4052 

p  =  0.1814 

p  =  0.3372 

p  =  -0.1314 

p  = -0.0154 

u  =  1025.0 

u  =  720.0 

u  =  859.5 

u  =  801.5 

u  =  514.5 

z  =  351.0 
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Appendix  C:  Trend  Data 


This  appendix  includes  the  data  for  the  trends  of  the  various  actor  countries  (source,  target,  and  unpaired)  over  the  1 0-year  and  five-year  interval  in  order 
to  determine  if  over  time  a  trend  toward  actor  characteristics  of  source,  target  and  unpaired  actors  could  be  observed.  The  first  set  of  tests  were  used  to 
detennine  the  existence  of  a  relationship  between  culture  and  cyber  actors;  the  second  set  of  tests  begins  the  task  of  measuring  the  cyber-culture  relation¬ 
ship.  The  correlational  testing  was  performed  in  order  to  determine  if  trends  existed  with  any  of  the  cultural  dimensions  among  the  three  groups  of  cyber 
actors.  The  year  was  used  as  the  independent  variable  and  the  dependent  value  was  the  median  score  for  each  dimension  of  each  actor  group  per  year. 


Results  that  are  statistically  insignificant  are  written  in  black.  Findings  with  a  strong  statistical  significance  are  written  in  red.  Finally,  findings  with  a 
moderate  statistical  significance  are  written  in  blue. 

PDI  Country  Trend  Data 


Source 

2004 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Z 

n/a 

-0.4 

n/a 

n/a 

n/a 

0.46 

-0.09 

1.63 

1.32 

1.62 

P 

n/a 

0.3446 

n/a 

n/a 

n/a 

0.3228 

-0.4641 

0.0516 

0.0934 

0.0526 

u 

n/a 

539 

n/a 

n/a 

n/a 

544.5 

459 

657 

740.5 

772.5 

Med 

69 

69.5 

66 

66 

64 

69.5 

69 

77 

73.5 

77.5 

Target 

Z 

n/a 

1.13 

-0.69 

n/a 

0.85 

0.08 

-0.29 

0.73 

-0.36 

1.11 

P 

n/a 

0.1292 

-0.2451 

n/a 

0.1977 

0.4681 

-0.3859 

0.2327 

-0.3594 

0.1335 

u 

n/a 

609 

479.5 

n/a 

527.5 

760 

617.5 

838.5 

706.5 

1048.5 

Med 

62 

74.5 

58 

66 

70 

69 

67 

70 

65 

72.5 

Both-ST 

Z 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

1.43 

1.46 

2.06 
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p 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

0.0764 

0.0721 

0.0197 

u 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

580 

525 

819.5 

Med 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

63.5 

77 

78.5 

78.5 

Unpaired 

Z 

1.77 

0.89 

0 

0.96 

1.07 

1.27 

1.82 

2.38 

2.07 

2.58 

P 

0.0384 

0.1867 

0.5 

0.1685 

0.1423 

0.102 

0.0344 

0.0087 

0.0192 

0.0049 

u 

963.5 

641 

901 

702.5 

714 

623 

1143.5 

1218.5 

1411 

1609 

Med 

78 

70 

67.5 

69.5 

70 

74 

73.5 

77.5 

77.5 

79 

Source 

Target 

Both-ST 

Unpaired 

2004 

69 

Spearman 

2004 

62 

Spearman 

2004 

2004 

78 

Spearman 

2005 

69.5 

10  year 

2005 

74.5 

1 0  year 

2005 

2005 

70 

10  year 

2006 

66 

r  =  0.6361 

2006 

58 

r  =  0.2918 

2006 

2006 

67.5 

r  =  0.4939 

2007 

66 

t  =  2.33 

2007 

66 

t  =  0.86 

2007 

2007 

69.5 

t  =  1.61 

2008 

64 

2008 

70 

2008 

2008 

70 

2009 

69.5 

5  year 

2009 

69 

5  year 

2009 

2009 

74 

5  year 

2010 

69 

II 

o 

CO 

2010 

67 

CO 

o 

II 

2010 

63.5 

2010 

73.5 

r  =  0.9 

2011 

77 

2011 

70 

2011 

77 

2011 

77.5 

2012 

73.5 

2012 

65 

2012 

78.5 

2012 

77.5 

2013 

77.5 

2013 

72.5 

2013 

78.5 

2013 

79 
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IVC  Country  Trend  Data 


Source 

2004 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Z 

n/a 

-0.59 

n/a 

n/a 

n/a 

-0.37 

-0.67 

-0.11 

-0.9 

-0.87 

P 

n/a 

-0.2776 

n/a 

n/a 

n/a 

-0.3557 

-0.2514 

-0.4562 

-0.1841 

-0.1922 

u 

n/a 

443 

n/a 

n/a 

n/a 

463.5 

389 

439.5 

504 

507.5 

Med 

30 

32.5 

38 

37 

38.7 

33.5 

37 

35 

30.5 

29 

Target 

Z 

n/a 

0.74 

1.82 

n/a 

0.95 

0.67 

1.15 

0.56 

1.14 

0.86 

P 

n/a 

0.2297 

0.0344 

n/a 

0.1711 

0.2514 

-0.1251 

0.2877 

0.1271 

0.1949 

u 

n/a 

572 

0.0344 

n/a 

536.5 

831.5 

778 

818 

888 

1015.5 

Med 

48.5 

35 

41 

38 

32 

38 

36.5 

35 

40 

7.5 

Both-ST 

Z 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

-0.11 

-0.59 

0.3 

P 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

-0.4562 

-0.2776 

0.3821 

u 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

439.5 

349 

568 

Med 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

39.5 

35 

30.5 

36 

Unpaired 

Z 

-0.67 

0.18 

0.31 

-0.46 

-0.33 

-0.38 

0.52 

-1 

-0.51 

-0.68 

P 

-0.2514 

0.4286 

0.3783 

-0.3228 

-3707 

-0.352 

0.3015 

-0.1587 

0.305 

-0.2483 

u 

669 

568.5 

942 

550.5 

564 

463 

829.5 

765.5 

1023.5 

1092.5 

Med 

30 

37 

33.5 

33.5 

31 

37.5 

30 

30 

30 

31 

Source 

Target 

Both-ST 

Unpaired 
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2004 

30 

Spearman 

2004 

48.5 

Spearman 

2004 

2004 

30 

Spearman 

2005 

32.5 

1 0  year 

2005 

35 

1 0  year 

2005 

2005 

37 

1 0  year 

2006 

38 

r  =  -0.2188 

2006 

41 

LO 

CM 

O 

II 

2006 

2006 

33.5 

r  =  -0.3399 

2007 

37 

t  =  -0.63 

2007 

38 

t  =  -0.73 

2007 

2007 

33.5 

t  =  -1.02 

2008 

38.7 

2008 

32 

2008 

2008 

31 

2009 

33.5 

5  year 

2009 

38 

5  year 

2009 

2009 

37.5 

5  year 

2010 

37 

r  =  -0.7 

2010 

36.5 

r  =  0.1 

2010 

39.5 

2010 

30 

r  =  -0.2 

2011 

35 

2011 

35 

2011 

35 

2011 

30 

2012 

30.5 

2012 

40 

2012 

30.5 

2012 

30 

2013 

29 

2013 

37.5 

2013 

36 

2013 

31 

M/F  Country  Trend  Data 


Source 

2004 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Z 

n/a 

1.89 

n/a 

n/a 

n/a 

0.47 

0.45 

1.03 

0.79 

1.02 

P 

n/a 

682.5 

n/a 

n/a 

n/a 

0.3192 

0.3264 

0.1515 

0.2148 

0.1539 

u 

n/a 

0.0294 

n/a 

n/a 

n/a 

545.5 

491 

544.5 

648 

708.5 

Med 

50 

55 

49 

46 

43 

47.5 

49 

52 

50 

51 

Target 

Z 

n/a 

2.66 

1.15 

1.15 

1.63 

1.31 

1.66 

1.66 

2.01 

1.39 

P 

n/a 

0.0039 

0.1251 

0.1251 

0.0516 

0.0951 

0.0485 

0.0485 

0.022 

0.0823 

u 

n/a 

756.5 

667.5 

667.5 

598.5 

908.5 

834.5 

950.5 

992 

1086.5 

Med 

63 

63 

56 

56 

51 

55 

52 

65 

56 

52 

Both-ST 
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z 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

1.03 

0.67 

0.62 

p 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

0.1515 

0.2514 

0.2676 

u 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

544.5 

457.5 

666.5 

Med 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

49.5 

52 

50 

50 

Unpaired 

Z 

-0.09 

1.62 

1.17 

1.86 

0.89 

1.42 

1.43 

0.9 

1.82 

2.03 

P 

-0.4641 

0.0526 

0.121 

0.0314 

0.1867 

0.0778 

0.0764 

0.1841 

0.0344 

0.0212 

u 

738.5 

714.5 

1056.5 

798.5 

695 

635 

1091.5 

1020.5 

1374.5 

1521 

Med 

45 

53 

50 

53.5 

47.5 

52.5 

51 

49.5 

52 

45 

Source 

Target 

Both-ST 

Unpaired 

2004 

50 

Spearman 

2004 

63 

Spearman 

2004 

2004 

45 

Spearman 

2005 

55 

1 0  year 

2005 

63 

10  year 

2005 

2005 

53 

1 0  year 

2006 

49 

r  =  0.1281 

2006 

56 

r  =  -0.3643 

2006 

2006 

50 

r  =  -0.1581 

2007 

46 

t  =  0.37 

2007 

56 

t  =  -1.11 

2007 

2007 

53.5 

t  =  -0.45 

2008 

43 

2008 

51 

2008 

2008 

47.5 

2009 

47.5 

5  year 

2009 

55 

5  year 

2009 

2009 

52.5 

5  year 

2010 

49 

II 

O 

2010 

52 

r  =  -0.1 

2010 

49.5 

2010 

51 

r  =  -0.7 

2011 

52 

2011 

65 

2011 

52 

2011 

49.5 

2012 

50 

2012 

56 

2012 

50 

2012 

52 

2013 

51 

2013 

52 

2013 

50 

2013 

45 
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UAI  Country  Trend  Data 


Source 

2004 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Z 

n/a 

0.44 

n/a 

n/a 

n/a 

-0.26 

0.45 

0.49 

-0.25 

-0.38 

P 

0.33 

n/a 

n/a 

n/a 

-0.3974 

0.3264 

0.3121 

-0.4013 

-0.352 

u 

542.5 

n/a 

n/a 

n/a 

474.5 

491 

547.5 

627 

559.5 

Med 

69 

68.5 

75 

76 

73 

64.5 

70 

68 

65 

60 

Target 

Z 

n/a 

0.69 

-0.31 

n/a 

-1.18 

-0.64 

-1.57 

0.12 

-1.42 

-0.42 

P 

0.2451 

-3783 

n/a 

-0.119 

-0.2611 

0.0582 

734.5 

-0.0778 

-0.3372 

u 

433.5 

518.5 

n/a 

342.5 

672 

475.5 

0.4522 

579 

844 

Med 

57.5 

58 

59 

46 

46 

60 

48.5 

65 

51 

60 

Both-ST 

Z 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

0.49 

-0.55 

0.04 

P 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

0.3121 

-0.2912 

0.484 

u 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

547.5 

325.9 

604.5 

Med 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

64.5 

68 

59.5 

64 

Unpaired 

Z 

1.89 

0.55 

0.09 

1.61 

1.54 

0.46 

0.2743 

1.21 

1.07 

0.94 

P 

0.0294 

0.2912 

0.4641 

0.0537 

0.0618 

0.3238 

0.6 

0.1131 

0.1423 

0.1736 

u 

977.5 

606 

912 

772 

764 

544.5 

980 

1061.5 

1261.5 

1349.5 

Med 

82 

75 

70 

76 

78 

69 

69 

70 

72.5 

70 

Source 

Target 

Both-ST 

Unpaired 
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2004 

69 

Spearman 

2004 

57.5 

Spearman 

2004 

2004 

82 

Spearman 

2005 

68.5 

10  year 

2005 

58 

1 0  year 

2005 

2005 

75 

10  year 

2006 

75 

r  =  -0.6 

2006 

59 

r  =  0.2683 

2006 

2006 

70 

r  = -0.5416 

2007 

76 

t  =  -2.12 

2007 

46 

t  =  0.79 

2007 

2007 

76 

t  =  -1 .82 

2008 

73 

2008 

46 

2008 

2008 

78 

2009 

64.5 

5  year 

2009 

60 

5  year 

2009 

2009 

69 

5  year 

2010 

70 

r  =  -0.4 

2010 

48.5 

r  =  0.1 

2010 

64.5 

2010 

69 

II 

O 

bo 

2011 

68 

2011 

65 

2011 

68 

2011 

70 

2012 

65 

2012 

51 

2012 

59.5 

2012 

72.5 

2013 

60 

2013 

60 

2013 

64 

2013 

70 

LvS  Country  Trend  Data 


Source 

2004 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Z 

n/a 

1.01 

n/a 

n/a 

n/a 

0.37 

-0.45 

-1 

-0.16 

-0.73 

P 

n/a 

0.1562 

n/a 

n/a 

n/a 

0.3557 

-0.3264 

-0.1587 

-0.4364 

-0.2337 

u 

n/a 

502.5 

n/a 

n/a 

n/a 

450.5 

343 

338 

489.5 

438 

Med 

44 

53 

44 

31 

43 

49.5 

47 

30 

44.5 

38.5 

Target 

Z 

n/a 

0.18 

-0.44 

n/a 

-1.37 

0.06 

-0.31 

-1.4 

-0.69 

-1.43 

P 

n/a 

0.4286 

-0.33 

n/a 

-0.053 

0.4761 

-0.3783 

-0.0808 

-2451 

-0.0764 

u 

n/a 

435.5 

423.5 

n/a 

272 

594.5 

475.5 

486 

520 

593 

Med 

60 

39.5 

44 

44 

27 

42.5 

41 

30 

35 

33 

Both-ST 
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z 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

-1 

0.08 

-0.77 

p 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

-0.1587 

0.4681 

-0.2207 

u 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

338 

330 

434 

Med 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

47 

30 

44 

38.5 

Unpaired 

Z 

-0.49 

0.53 

0.04 

-0.08 

-0.29 

-0.27 

-0.6 

-0.58 

-0.11 

0.19 

P 

-0.3121 

0.2981 

0.0484 

-0.4681 

-0.3859 

-0.3936 

-0.2743 

-0.281 

-0.4562 

0.4247 

u 

539 

464 

761.5 

496 

436.5 

397.5 

647.5 

649.5 

909 

940.5 

Med 

38 

46.5 

42.5 

40 

44 

40 

44 

44 

45.5 

44 

Source 

Target 

Both-ST 

Unpaired 

2004 

44 

Spearman 

2004 

60 

Spearman 

2004 

2004 

38 

Spearman 

2005 

53 

1 0  year 

2005 

39.5 

1 0  year 

2005 

2005 

46.5 

1 0  year 

2006 

44 

r  = -0.2614 

2006 

44 

r  =  -0.6322 

2006 

2006 

42.5 

r  =  0.3952 

2007 

31 

t  =  -0.77 

2007 

44 

t  =  -2.31 

2007 

2007 

40 

t  =  1.22 

2008 

43 

2008 

27 

2008 

2008 

44 

2009 

49.5 

5  year 

2009 

42.5 

5  year 

2009 

2009 

40 

5  year 

2010 

47 

r  =  -0.7 

2010 

41 

r  =  -0.7 

2010 

47 

2010 

44 

II 

O 

2011 

30 

2011 

30 

2011 

30 

2011 

44 

2012 

44.5 

2012 

35 

2012 

44 

2012 

45.5 

2013 

38.5 

2013 

33 

2013 

38.5 

2013 

44 
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IYR  Country  Trend  Data 


Source 

2005 

2006 

2007 

2008 

2009 

2010 

2011 

2012 

2013 

Z 

-0.69 

n/a 

n/a 

n/a 

-1.78 

-1.57 

-1.89 

-1.31 

-1.43 

P 

-0.2451 

n/a 

n/a 

n/a 

-0.0375 

-0.0582 

0.0588 

-0.0951 

-0.0764 

u 

341.5 

n/a 

n/a 

n/a 

257.5 

241 

218 

328 

318 

Med 

40 

49 

59 

44.5 

32 

38 

37 

40 

40 

Target 

Z 

0.06 

0 

n/a 

0.1 

-0.71 

-0.39 

-1.52 

-0.4 

0.6 

P 

0.4761 

0.5 

n/a 

0.4602 

-0.2389 

-0.3483 

0.0643 

-0.3446 

0.2743 

u 

400.5 

434 

n/a 

363 

450 

364.5 

377.5 

477 

608.5 

Med 

54.5 

49 

59 

52 

52 

40 

40 

49 

43 

Both-ST 

Z 

P 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

-1.89 

-1.21 

-2.22 

u 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

0.0588 

0.1131 

-0.0132 

Med 

n/a 

n/a 

n/a 

n/a 

n/a 

n/a 

218 

199.5 

254 

n/a 

n/a 

n/a 

n/a 

n/a 

33 

37 

40 

26 

Unpaired 

Z 

P 

z=  -0.43 

-0.65 

0.28 

-1.34 

-1.03 

-2.41 

-2.86 

-2.24 

-2.18 

u 

p=  -0.3336 

-0.2578 

0.3897 

0.0901 

-0.1515 

0.0008 

0.0021 

0.0125 

0.0146 

Med 

u=  361.5 

640 

498 

325.5 

315 

389.5 

344 

564.5 

604 

med  40 

42 

47.5 

40 

39 

30 

27 

30 

32 
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Source 

Target 

Both-ST 

Unpaired 

2004 

Spearman 

2004 

49 

Spearman 

2004 

2004 

45 

Spearman 

2005 

10  year 

2005 

54.5 

10  year 

2005 

2005 

40 

10  year 

2006 

r  =  -0.5601 

2006 

49 

r  =  -0.5495 

2006 

2006 

42 

r  =  -0.8049 

2007 

t  =  -1.91 

2007 

59 

t  =  -1 .86 

2007 

2007 

47.5 

t  =  -3.84 

2008 

2008 

52 

2008 

2008 

40 

2009 

5  year 

2009 

52 

5  year 

2009 

2009 

39 

5  year 

2010 

r  =  0.8721 

2010 

40 

C\J 

O 

II 

2010 

33 

2010 

30 

r  =  -0.2 

2011 

2011 

40 

2011 

37 

2011 

27 

2012 

2012 

49 

2012 

49 

2012 

30 

2013 

2013 

43 

2013 

26 

2013 

32 
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Appendix  D:  Kinetic  Post-Filtered  Data 


This  appendix  includes  the  data  from  the  ICEWS  data  about  kinetic  events  after  all  filters  had  been  applied,  organized  by  target  actor  countries. 


Results  that  are  statistically  insignificant  are  written  in  black.  Findings  with  a  strong  statistical  significance  are  written  in  red.  Finally,  findings  with  a 
moderate  statistical  significance  are  written  in  blue. 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Days 

Average 

Albania 

90 

20 

80 

70 

61 

15 

29 

29 

Bangladesh 

80 

20 

55 

60 

47 

20 

17.75 

9.88 

Bangladesh 

80 

20 

55 

60 

47 

20 

2 

Brazil 

69 

38 

49 

76 

44 

59 

11 

Brazil 

69 

38 

49 

76 

44 

59 

21.6 

Brazil 

69 

38 

49 

76 

44 

59 

20 

13.18 

Brazil 

69 

38 

49 

76 

44 

59 

6 

Brazil 

69 

38 

49 

76 

44 

59 

9.5 

Brazil 

69 

38 

49 

76 

44 

59 

11 

Chile 

63 

23 

28 

86 

31 

68 

17 

17 

China 

80 

20 

66 

30 

87 

24 

11.66 

12.33 

China 

80 

20 

66 

30 

87 

24 

13 

Egypt 

70 

25 

45 

80 

7 

4 

6.5 

6.5 

Greece 

60 

35 

57 

100 

45 

50 

18 

18 

India 

77 

48 

56 

40 

51 

26 

2.8 

7.07 

India 

77 

48 

56 

40 

51 

26 

10.8 

India 

77 

48 

56 

40 

51 

26 

9 

India 

77 

48 

56 

40 

51 

26 

7.92 
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Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Days 

Average 

India 

77 

48 

56 

40 

51 

26 

4.86 

Indonesia 

78 

14 

46 

48 

62 

38 

10 

Indonesia 

78 

14 

46 

48 

62 

38 

5 

Indonesia 

78 

14 

46 

48 

62 

38 

8 

Indonesia 

78 

14 

46 

48 

62 

38 

4 

Indonesia 

78 

14 

46 

48 

62 

38 

8.75 

Indonesia 

78 

14 

46 

48 

62 

38 

13 

Indonesia 

78 

14 

46 

48 

62 

38 

16 

Iran 

58 

41 

43 

59 

14 

40 

13 

1 

Iran 

58 

41 

43 

59 

14 

40 

15.5 

Iran 

58 

41 

43 

59 

14 

40 

18 

Iran 

58 

41 

43 

59 

14 

40 

16.8 

Iran 

58 

41 

43 

59 

14 

40 

9.5 

Iran 

58 

41 

43 

59 

14 

40 

11.33 

Iran 

58 

41 

43 

59 

14 

40 

21.5 

Iran 

58 

41 

43 

59 

14 

40 

4 

Iraq 

95 

30 

70 

85 

25 

17 

5.57 

Italy 

50 

76 

70 

75 

61 

30 

5 

Malaysia 

100 

26 

50 

36 

41 

57 

6 

Mexico 

81 

30 

69 

82 

24 

97 

14.75 

1 

Mexico 

81 

30 

69 

82 

24 

97 

8.5 

Pakistan 

55 

14 

50 

70 

50 

0 

1 

Pakistan 

55 

14 

50 

70 

50 

0 

15 

Pakistan 

55 

14 

50 

70 

50 

0 

9.2 

Pakistan 

55 

14 

50 

70 

50 

0 

14.8 
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Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Days 

Average 

Pakistan 

55 

14 

50 

70 

50 

0 

14.66 

Pakistan 

55 

14 

50 

70 

50 

0 

5.2 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

16 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

29 

Syria 

80 

35 

52 

60 

30 

Null 

14.5 

Syria 

80 

35 

52 

60 

30 

Null 

10 

Syria 

80 

35 

52 

60 

30 

Null 

12 

Taiwan 

58 

17 

45 

69 

93 

49 

15 

Taiwan 

58 

17 

45 

69 

93 

49 

12 

Turkey 

66 

37 

45 

85 

49 

49 

10.33 

Turkey 

66 

37 

45 

85 

49 

49 

18 

Turkey 

66 

37 

45 

85 

49 

49 

4 

Turkey 

66 

37 

45 

85 

49 

49 

11.5 

Turkey 

66 

37 

45 

85 

49 

49 

17 

Turkey 

66 

37 

45 

85 

49 

49 

3 

Multi-year 


Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Days 

Average 

Albania 

90 

20 

80 

70 

61 

15 

29 

Bangladesh 

80 

20 

55 

60 

47 

20 

17.75 

Brazil 

69 

38 

49 

76 

44 

59 

20 

Chile 

63 

23 

28 

86 

31 

68 

17 

China 

80 

20 

66 

30 

87 

24 

11.67 

Egypt 

70 

25 

45 

80 

7 

4 

6.5 
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Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Days 

Average 

Greece 

60 

35 

57 

100 

45 

50 

18 

India 

77 

48 

56 

40 

51 

26 

2.8 

Indonesia 

78 

14 

46 

48 

62 

38 

10 

Iran 

58 

41 

43 

59 

14 

40 

13 

Iraq 

95 

30 

70 

85 

25 

17 

5.57 

Italy 

50 

76 

70 

75 

61 

30 

5 

Malaysia 

100 

26 

50 

36 

41 

57 

6 

Mexico 

81 

30 

69 

82 

24 

97 

14.75 

Pakistan 

55 

14 

50 

70 

50 

0 

1 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

26 

Syria 

80 

35 

52 

60 

30 

Null 

14.5 

Taiwan 

58 

17 

45 

69 

93 

49 

15 

Turkey 

66 

37 

45 

85 

49 

49 

10.33 

15 

29 

20 

9.87 

59 

13.18 

68 

17 

24 

12.33 

4 

6.5 

50 

18 

26 

7.07 

38 

9.25 

40 

13.47 

17 

5.56 
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Country 

PDI 

IVC 

M/F 

UAI 

LvS 

IVR 

Days 

Average 

30 

5 

57 

6 

97 

14.75 

0 

9.9 

52 

22.5 

49 

13.5 

49 

10.6 

r  =  0.0062 

r  =  -0.1866 

r  =  0.0147 

r  =  0.2978 

r  =  0.1404 

r  =  0.3970 

Bangladesh 

80 

20 

55 

60 

47 

20 

9.87 

Brazil 

69 

38 

49 

76 

44 

59 

13.18 

China 

80 

20 

66 

30 

87 

24 

11.66 

India 

77 

48 

56 

40 

51 

26 

7.07 

Indonesia 

78 

14 

46 

48 

62 

38 

9.25 

Iran 

58 

41 

43 

59 

14 

40 

13.47 

Mexico 

81 

30 

69 

82 

24 

97 

14.75 

Pakistan 

55 

14 

50 

70 

50 

0 

9.9 

Saudi  Arabia 

95 

25 

60 

80 

36 

52 

22.5 

Syria 

80 

35 

52 

60 

30 

Null 

12.16 

Taiwan 

58 

17 

45 

69 

93 

49 

13.5 

Turkey 

66 

37 

45 

85 

49 

49 

10.6 

r  =  0.2363 

r  =  -0.0095 

r  =  0.0805 

r  =  0.5113 

r  =  -0.4680 

r  =  0.7107 
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Appendix  E:  Cyber  and  Kinetic  Time-Interval  Data 


This  appendix  provides  the  data  that  was  used  to  measure  time  intervals  between  cyber  and  kinetic  events.  The  time  interval  was  based  on  the  nearest 
cyber  and  kinetic  dates.  This  was  chosen  due  to  the  uncertainty  in  pairing  the  events.  The  maximum  interval  between  events  was  set  to  30  days.  This 
value,  while  not  perfect,  was  chosen  as  a  baseline;  in  reality  most  events  occurred  within  14  days.  Tests  were  performed  across  all  six  dimensions  for  10- 
year  and  five-year  values  in  order  to  test  H4  and  H5.  The  hypothesis  test  set  the  cultural  dimension  as  the  independent  variable  and  the  time  interval  as  the 
dependent  variable. 

The  kinetic  event  dates  were  aligned  against  the  cyber  event  dates.  Cyber  and  kinetic  pairs  were  evaluated  by  country  pairs  for  each  year.  A  total  of  1,270 
events  were  examined  and  186  pairs,  or  372  entries,  were  matched.  When  multiple  events  between  pairs  occurred  in  a  year,  those  events  were  averaged. 


Cyber  and  Kinetic  Pairings  (2004) 


Source 

Target 

Date 

France 

China  kinetic 

1/26/2004, 

X 

X 

X 

Cyber 

X 

8/29/04 

9/22/04 

09/25/2004, 

Taiwan 

China  kinetic 

3/10/04 

X 

10/13/04 

11/27/04 

12/27/04 

(12  days) 

Cyber 

X 

08/29, 

10/1, 

X 

X 

United  States 

China 

0/5/04 

X 

cyber 

X 

07/03, 

Iraq 

Poland  (kin.) 

5/4/04 

X 

cyber 

04/20, 

11/29, 

14  days 

kinetic 

cyber 

China 

Taiwan 

1/16/04 

X 
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Source 

Target 

Date 

1/28/04 

X 

3/25/04 

X 

4/1/04 

X 

4/15/04 

X 

5/5/04 

X 

5/12/04 

X 

5/25/04 

X 

08/09, 

X 

08/15, 

X 

09/15, 

08/31, 

10/13, 

09/30, 

11/12, 

X 

11/27, 

11/20, 

Iraq 

Turkey  (kin.) 

9/29/04 

11/14/04 

Cyber 

04/20, 

11/29/15 

Malaysia 

United  Kingdom 
(kinetic) 

5/3/04 

X 

Cyber 

X 

2/6/15 

Iraq 

United  States 

Cyber 

Kinetic 

X 

02/8/04 

X 

04-07 

04/09 

X 

04/12/04 

X 

04/16/04 
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Source 

Target 

Date 

X 

04/22-04/23 

04/26, 

04/25, 

1 

1 

X 

05/01 , 05/03-05/04 

05/11 

X 

05/16-05/17 

X 

05/19-05/21, 

X 

05/24 

X 

06/04/04 

X 

6/7/04 

06/10, 

3 

8/5/04 

08/04, 

1 

1 

11/28/04 

11/29, 

1 

12/2/04 

X 

12/13/04 

12/16, 

3 

3 

12/19/04 

12/16, 

3 

12/21/04 

12/23, 

2 

2 

Brazil 

United  States 

11/5/04 

11/5/04 

11 

cyber 

10/25/04, 

10/25/04, 

11  days 

01/23,01/26 

05/01,08/12, 

08/30,  12/22/, 

03/06,  05/2 

10/24,  11/29, 

07/21 , 

08/1 1  ,  09/06 
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Cyber  and  Kinetic  Pairings  (2005) 


Source 

Target 

Date 

Greece 

Albania 

Kinetic 

X 

11/1  -  11/3 

nothing 

Cyber 

04/04, 

X 

Mexico 

Argentina 

Kinetic 

01/06, 

04/19, 

11/4/05 

9.5 

Cyber 

X 

04/15, 

11/19, 

4  days 

15  days 

k-c 

08/11, 09/23,  10/11  12/20, 

Brazil 

Argentina 

Kinetic 

5/10/05 

nothing 

Cyber 

06/13, 

33  days 

09/22,  01/17,  01/29,  02/20,  06/14,  02/16, 

Mexico 

Brazil 

Kinetic 

05/10/05 

X 

X 

Cyber 

04/15, 

06/16, 

09/23, 

25  days 

25 

Brazil 

China 

Kinetic 

10/3/05 

Cyber 

10/12, 

9  days 

9 

Indonesia 

China 

kinetic 

5/9/05 

X 

cyber 

X 

12/08, 

Taiwan 

China 

1/1/05 

X 
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Source 

Target 

Date 

Taiwan 

China 

2/20/05 

X 

Taiwan 

China 

3/14/05 

X 

Taiwan 

China 

3/20/05 

X 

Taiwan 

China 

3/24/05 

X 

Taiwan 

China 

4/1/05 

X 

Taiwan 

China 

4/4/05 

X 

Taiwan 

China 

4/8/05 

04/23, 

15  days 

Taiwan 

China 

5/9/05 

04/23, 

16 

same  cyber  event  count  nearest  pair 

Taiwan 

China 

5/13/05 

X 

Taiwan 

China 

5/27/05 

X 

Taiwan 

China 

7/7/05 

X 

Taiwan 

China 

7/14/05 

X 

Taiwan 

China 

8/1 6/05 

X 

Taiwan 

China 

1 0/4/05 

X 

Taiwan 

China 

10/18/05 

X 

Taiwan 

China 

11/12/05 

X 

Taiwan 

China 

11/15/05 

X 

Taiwan 

China 

12/24/05 

X 

Indonesia 

Malaysia 

1/25/05 

03/08, 

04/25, 

03/10, 

04/07, 

2 

18 

China 

Philippines 

kinetic 

05/5/05 

X 

X 
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Source 

Target 

Date 

cyber 

X 

10/29, 

11/10, 

Germany 

Poland 

kinetic 

04/16/05 

X 

cyber 

X 

07/22, 

Albania 

Saudi  Arabia 

kinetic 

05/25, 

6/9/05 

cyber 

04/26, 

X 

29  days 

Iran 

United  Kingdom 

X 

02/11/05 

X 

05/25, 

01/07,  01/09 

X 

04/09, 

X 

Indonesia 

United  States 

kinetic 

01/15-01/16 

05/27, 

X 

09/24, 

cyber 

X 

X 

08/08, 

X 

Brazil 

United  States 

kinetic 

03/23/05 

10/27, 

11/05, 

cyber 

02/24, 

09/27, 

11/14, 

27 

30 

9 

China 

United  States 

kinetic 

05/10, 

05/24, 

X 

12/22, 

cyber 

X 

X 

11/10, 

X 
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Source 

Target 

Date 

Iran 

United  States 

kinetic 

05/24, 

06/19, 

07/03, 

07/06, 

11/30, 

12/1  - 12/2, 

cyber 

04/23, 

X 

X 

X 

X 

12/28, 

31  days 

26  days 

Mexico 

United  States 

kinetic 

02/01 , 

03/18, 

04/07, 

06/01-06/02, 

cyber 

X 

X 

X 

06/16, 

14  days 

Morocco 

United  States 

Kinetic 

X 

8/17/05 

Cyber 

06/13, 

X 

Cyber  and  Kinetic  Pairings  (2006) 


Source 

Target 

Date 

Mexico 

Argentina 

Kinetic 

02/03, 

04/10, 

Cyber 

X 

04/08, 

2  days 

Indonesia 

Australia 

Kinetic 

3/27/06 

4/18/06 

6/5/06 

Australia 

Cyber 

04/01/, 

X 

X 

5  days 

Mexico 

Brazil 

Kinetic 

3/28/06 

7/20/06 

8/15/06  x 

Cyber 

04/12, 

X 

X  02/19 

15  days 
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Source 


Target 


Date 


Iran 

India 

Kinetic 

9/20/06 

11/17/06 

Cyber 

X 

X 

Brazil 

Iran 

Kinetic 

4/19/06 

Cyber 

03/05, 

45  days 

United  States 

Philippines 

Kinetic 

01/24, 

01/28, 

Cyber 

X 

X 

Iran 

Russian  Federation 

Kinetic 

03/10, 

X 

Cyber 

X 

6/13/06 

Iran 

Turkey 

Kinetic 

X 

X 

Cyber 

04/20, 

07/09, 

Kinetic 

Cyber 

Iran 

United  Kingdom 

2/8/06 

01/17, 

22  days 

02/14, 

X 

02/18, 

X 

X 

05/13, 

X 

08/04, 
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Source 

Target 

Date 

Brazil 

United  States 

Kinetic 

10/14/06 

Cyber 

11/22, 

39  days 

Kinetic 

Cyber 

Italy 

United  States 

3/6/06 

X 

3/13/06 

X 

3/23/06 

03/28, 

4/25/06 

X 

7/22/06 

X 

11/21/06 

X 

Indonesia 

United  States 

Kinetic 

Cyber 

3/15/06 

X 

2/19/2006-  02/20/2006  x 

11/14/2006  -  11/20/2006 

X 

X 

06/06-  06/07, 

X 

06/26, 

Turkey 

United  States 

Kinetic 

3/24/06 

Cyber 

X 

Kinetic 

Cyber 

Iran 

United  States 

1/16/06 

X 
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X 


5  days 

X 

07/18,  07/21,  07/24-  07/25,  07/29,  08/02,  11/15,  11/23,  12/11,  12/14, 

'ERSITY 


71 


Source 

Target 

Date 

1/20/06 

X 

5/3/06 

04/30, 

3  da 

8/10/2006  -08/11/2006 

07/22, 

18  d 

8/30/06 

X 

09/05/06-09/06/07 

X 

11/28/2006  -  11/30/2006 

X 

12/30/06 

X 

X 

06/04, 

Iran 

Pakistan 

Kinetic 

08/29,  08/31 

X 

Cyber 

X 

12/3 
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Cyber  and  Kinetic  Pairings  (2007) 


Source 

Target 

Date 

Chile 

Argentina 

kinetic 

3/9/07 

1 7  days 

cyber 

2/20/15 

17  days 

Turkey 

Brazil 

kinetic 

2/16/07 

X 

cyber 

1/28/15 

07/28,  01/11,  05/03,  10/08,  11/22,  10/30,  07/20,  08/19, 

1 9  days 

19  days 

Mexico 

Brazil 

kinetic 

X 

5/19/07 

05/22, 

Nothing 

cyber 

3/8/1 5 

X 

X 

Indonesia 

China 

kinetic 

6/8/07 

X 

Nothing 

cyber 

X 

11/04, 

Mexico 

China 

kinetic 

8/20/07 

X 

Nothing 

cyber 

X 

04/1 2,  04/1 8-04/1 9,  03/1 1  -  03/1 2,  03/1 5, 

Indonesia 

Malaysia 

kinetic 

8/29/07 

X 

8  days 

cyber 

8/21/15 

07/18, 

8  days 

United  States 

Turkey 

kinetic 

X 

10/21/07 

Nothing 

cyber 

01/08, 

X 
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Source 

Target 

Date 

Turkey 

United  Kingdom 

kinetic 

X 

X 

11/24/07 

1 0  days 

cyber 

01/03,  01/11,  01/25,  07/12,  07/29, 

11/14, 

1 0  days 

Iran 

United  States 

Kinetic 

Cyber 

01/11/2007 

01/16/2007 

5  days 

X 

01/24 

X 

02/16 

03/29-03/30/2007 

03/03/2007 

26 

04/18/2007 

X 

05/04-05/05/2007 

X 

5/7/07 

X 

5/10/07 

X 

5/12-  05/13/07 

X 

5/15/07 

X 

5/19/07 

X 

5/23/07 

X 

5/25/2007  -  05/28/2007 

X 

5/31/07 

X 

8/20/07 

X 

9/23/07 

X 

10/2/07 

X 

1 0/7/07 

X 

10/31/07 

X 
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Source 

Target 

Date 

11/9/07 

X 

11/13/07 

X 

11/16/2007 

X 

Turkey 

United  States 

kinetic 

11/3/07 

12/18/07 

X 

cyber 

11/01, 

X 

04/13,  04/21,  01/14,  01/26,  03/01,  10/09 

2  days 

Brazil 

United  States 

kinetic 

3/8/2007  -  03/09/2007 

04/18, 

06/04  -  06/05, 

X 

1 5  days 

cyber 

03/28, 

04/28, 

X 

01/03/05/04,  See  CD 

20 

10 

Brazil 

United  Kingdom 

kinetic 

11/02, 

X 

25  days 

cyber 

11/27, 

01/03,  04/28,  05/04,  07/21, 01/28,  03/28,  07/14,  07/22, 

25  days 

k-c 
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Cyber  and  Kinetic  Pairings  (2008) 


Source 

Target 

Date 

Brazil 

Argentina 

kinetic 

1/1/08 

X 

cyber 

X 

03/12,  10/03,  07/26,  08/14,  09/24, 

Iran 

Egypt 

kinetic 

4/14/08 

12/31/08 

X 

cyber 

X 

X 

07/13,  07/15,  09/24 

kinetic 

cyber 

Pakistan 

India 

1/27/08 

X 

2/13/08 

X 

7/7  -8 

X 

7/26/08 

X 

7/28/2008-08/03/2008 

X 

8/16/08 

X 

8/19/08 

X 

8/25/08 

X 

8/27/08 

X 

9/28/08 

X 

10/4/08 

X 

12/15/2008-  12/16/2008 

12/14, 

12/19/08 

12/18,  X 

Iran 

Jordan 

kinetic 

11/17/08 

X 

cyber 

X 

04/18,  05/30 
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Source 

Target 

Date 

Turkey 

Malaysia 

kinetic 

7/2/08 

X 

cyber 

X 

08/13,  09/08-  09/09,  09/12,  10/27,  12/03,  12/09 

Iran 

Philippines 

kinetic 

6/2/2008  -  06/03/2008 

X 

cyber 

6/20/15 

04/16,  04/27,  08/13, 

18  days 

s 

Turkey 

Saudi  Arabia 

kinetic 

11/26/2008  -11/27/2008, 

X 

cyber 

X 

04/16-  04/17,  06/10,  01/30,  02/10,  02/14, 

Iran 

United  Kingdom 

kinetic 

12/31/08 

X 

cyber 

X 

07/22, 

Kinetic 

cyber 

Iran 

United  States 

1/8/08 

X 

1/13/08 

X 

1/23/08 

X 

3/4/08 

X 

3/9/08 

X 

5/2/08 

X 

9/5/08 

X 

9/23/08 

X 

1 0/2/08 

X 

10/3/08 

X 

10/12/08 

X 

CMU/SEI-2015-SR-025  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON  UNIVERSITY 
Distribution  Statement  A:  Approved  for  Public  Release;  Distribution  is  Unlimited 


77 


Source 

Target 

Date 

10/29/08 

X 

11/3/08 

X 

11/6/08 

X 

11/8/2008  -11/11/2008 

X 

11/30/08 

X 

12/24/08 

X 

Turkey 

United  States 

kinetic 

3/8/08 

X 

cyber 

03/26, 

04/26,  08/20,  02/10,  02/13,  04/28,  08/24, 

18  days 

Brazil 

United  States 

kinetic 

4/10/08 

10/27/08 

11/4/08 

X 

cyber 

X 

10/21/08 

X 

01/18,  10/21,  06/02, 

6  days 
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Cyber  and  Kinetic  Pairings  (2009) 


Source 

Target 

Kinetic 

Cyber 

Iran 

Argentina 

9/29/09 

04/05, 

India 

Australia 

5/31/09 

X 

9/21/09 

X 

X 

12/30, 

India 

Bangladesh 

3/16/09 

X 

3/22/09 

X 

4/25/09 

X 

4/27/2009  -  4/28/09 

X 

6/13/09 

X 

7/17/09 

X 

X 

09/12, 

8/1/09 

X 

12/11/09 

12/17, 

6  days 

Iran 

Brazil 

9/24/09 

X 

11/21/09 

12/18, 

27  days 

Turkey 

China 

7/7/09 

07/09, 

2  days 

06/24, 

X 

Netherlands 

China 

7/6/09 

X 

7/9-  07/1 0 

X 

X 

12/24, 
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Source 

Target 

Kinetic 

Cyber 

Iran 

Egypt 

1/1/09 

X 

1/11/09 

X 

1/12/09 

X 

X 

04/02  -  04/03, 

X 

04/17, 

X 

04/21 , 

X 

08/22, 

12/21/09 

X 

Pakistan 

India 

3/21/09 

X 

3/27/09 

04/02, 

6/29/09 

X 

7/5/09 

X 

8/5/09 

X 

8/31/09 

X 

09/01-  09/02, 

X 

X 

11/07,  11/15, 

9/22/09 

X 

10/2/09 

X 

12/6/09 

11/12, 

12/19/09 

X 

X 

04/09,  04/1 6,  05/05, 

Indonesia 

Malaysia 

9/2/09 

09/06, 
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Source 

Target 

Kinetic 

10/20-10/21, 

X 

Turkey 

Nepal 

4/17/09 

X 

Iran 

Pakistan 

1/1/09 

10/21/09 

India 

Pakistan 

1/27/09 

3/15/09 

3/17/09 

4/24/09 

5/30/09 

6/1/09 

6/3/09 

7/5/09 

9/19/09 

9/22/09 

10/9/09 

10/14/09 

11/15-11/17 

11/20/09 

12/25/09 
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05/17,  06/20,  09/06,  09/12,  11/21, 09/14, 

11/01, 

X 

05/14, 

X 

X 

X 

X 

X 

X 

X 

X 

09/18, 

09/21, 

10/10, 

11/25, 

X 

MELLON  UNIVERSITY 


Source 

Target 

Kinetic 

Cyber 

Turkey 

Russian  Federation 

12/20/09 

12/26, 

6  days 

Iran 

Saudi  Arabia 

10/20/09 

X 

11/2/09 

X 

X 

07/01,  12/16, 

Iran 

United  Kingdom 

6/20/09 

05/28, 

23 

6/23/09 

X 

6/28-  06/29, 

X 

7/1/09 

X 

12/2/09 

12/12, 

10 

Brazil 

United  States 

4/20/09 

04/12, 

8  days 

3/17/09 

X 

1/15/09 

X 

1/20/09 

02/01, 

1 2  days 

8/29/09 

X 

9/17/09 

09/19, 

2  days 

11/5/09 

10/19, 

1 6  days 

X 

07/07, 

Iran 

United  States 

1/15/09 

01/14, 

1  day 

c-k 

01/21  -  01/24, 

X 

1/26/09 

X 

1/28  -  01/31, 

X 
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Source 

Target 

Kinetic 

2/2  -  02/04 

2/7/09 

2/10/09 

2/12/09 

04/16  -  04/17, 

4/21/09 

5/6/09 

5/11/09 

3/26/09 

3/28/09 

4/9/09 

5/25/09 

8/15/09 

9/14/09 

12/29/09 

9/23/09 

9/25/09 

10/28/09 

11/4/09 

X 

Iraq 

United  States 

1/20/09 

2/23/09 

02/24  -  02/27, 

05/02  -  05/03, 

CMU/SEI-2015-SR-025  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON 
Distribution  Statement  A:  Approved  for  Public  Release;  Distribution  is  Unlimited 


x 


Source 

Target 

Kinetic 

Cyber 

5/5/09 

X 

5/12/09 

X 

05/16  -  05/17 

X 

4/13/09 

X 

5/31/09 

X 

6/8/09 

X 

6/29/09 

X 

7/3/09 

X 

7/5/09 

X 

07/26  -  07/27 

X 

X 

11/02, 

Egypt 

United  States 

5/20/09 

X 

5/27/09 

X 

8/4/09 

X 

8/6/09 

X 

11/26/09 

1 0/25, 

11/27/09 

X 

China 

India 

9/23/,  09/24, 

02/01-  02/02, 

09/06, 

1 3  days 

Turkey 

United  States 

2/26/09 

X 

nothing 

CMU/SEI-2015-SR-025  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON  UNIVERSITY 
Distribution  Statement  A:  Approved  for  Public  Release;  Distribution  is  Unlimited 


Cyber  and  Kinetic  Pairings  (2010) 


Source 

Target 

Date 

Argentina 

Brazil 

Kinetic 

6/18/10 

08/07, 

cyber 

02/16,  x 

X 

Turkey 

China 

kinetic 

10/9/10 

cyber 

09/30 

1 0  days 

Kinetic 

Cyber 

Pakistan 

India 

1/19/10 

01/02, 

17 

c-k 

3/4/10 

03/08, 

4 

k-c 

5/1/10 

04/23, 

8 

c-k 

5/19/10 

X 

5/23/1 0 

X 

6/20/10 

X 

6/22/1 0 

X 

7/7/2010-7/8/10 

X 

7/17/10 

X 

8/4/10 

07/29, 

6 

c-k 

8/22/1 0 

X 

10/25/10 

10/14, 

11 

c-k 

X 

01/02,  04/14,  09/28,  12/10, 

Brazil 

Iran 

kinetic 

3/3/10 

05/10, 

05/15, 

X 
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Source 


Target 


Date 


cyber 

X 

X 

X 

06/25, 

Iran 

Iraq 

kinetic 

4/10/2010-4/11/10 

5/13/2010  -5/14/10 

7/17/10 

X 

cyber 

X 

X 

X 

11/06-11/07 

Kinetic 

cyber 

Turkey 

Israel 

1/18/10 

02/26, 

39  days 

5/31/10 

X 

6/2/10 

X 

8/3/10 

X 

12/7/10 

X 

12/10/10 

X 

Bangladesh 

Malaysia 

kinetic 

2/24/10 

X 

cyber 

X 

04/08, 

Egypt 

Malaysia 

kinetic 

2/26/1 0 

X 

06/23, 

cyber 

X 

05/15, 

X 

Indonesia 

Malaysia 

kinetic 

Cyber 

3/3/10 

02/19, 

12  days 

4/12/10 

04/27, 

15  days 
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Source 

Target 

Date 

8/27/10 

08/31,  08/23, 

4 

c-k 

10/15/10 

10/09, 

4 

X 

05/12,  08/31, 08/01, 08/22,  09/21,  , 

X 

10/03,  10/08,  10/25,  12/28,  05/11 

India 

Nepal 

kinetic 

12/3/10 

X 

X 

cyber 

X 

01/14, 

02/20, 

Kinetic 

India 

Pakistan 

1/19/2010  -  1/20/10 

X 

1/23/10 

X 

1/26/2010-  1/28/10 

02/22, 

26  days 

k-c 

3/23/2010  -  3/24/10 

03/23, 

1  day 

k-c 

4/6/10 

X 

4/10/10 

X 

5/1/10 

04/25, 

6  days 

c-k 

05/04-05/05 

X 

5/8/10 

X 

5/23/1 0 

X 

5/25/1 0 

X 

7/8/10 

X 

7/14/10 

X 

7/23/1 0 

X 

8/2/10 

07/29, 

4  days 

c-k 

8/31/10 

08/13, 

1 9  days 

c-k 
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Source 

Target 

Date 

9/2-  09/03/10 

10/3/10 

10/30/10 

11/5/10 

11/20/10 

12/11/10 

12/21/10 

12/27/10 

Iran 

Pakistan 

kinetic 

cyber 

1/14/10 

X 

7/19/10 

X 

12/20/10 

X 

X 

10/28,  02/17,  09/11, 

Turkey 

Syria 

kinetic 

7/29/2010-7/30/10 

cyber 

X 

kinetic 

Iran 

United  Kingdom 

2/11/10 

2/16/10 

8/16/10 

11/4/10 

11/6/10 
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Source 


Target 


Date 


12/12/2010  -  12/13/10 

12/17/10 

Brazil 

United  States 

kinetic 

3/9/10 

cyber 

4/9/15 

Egypt 

United  States 

kinetic 

2/15/10 

cyber 

X 

Iran 

United  States 

kinetic 

1/13/10 

cyber 

2/28/1 0 

4/17/10 

6/8/10 

7/6/10 

8/2/10 

8/29/1 0 

8/31/10 

9/13/10 

9/19/10 

10/29/10 

11/5/2010-11/6/10 

12/3/10 

Turkey 

United  States 

kinetic 

3/8/10 

cyber 

02/23, 
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Cyber  and  Kinetic  Pairings  (2011) 


Source 

Target 

Date 

India 

Bangladesh 

1/10/11 

X 

1/22/11 

X 

2/1/11 

02/21, 

20  days 

4/25/1 1 

X 

5/1/11 

X 

8/11/11 

X 

8/24/1 1 

X 

9/11/11 

X 

12/18/11 

X 

Iran 

Egypt 

kinetic 

2/13/11 

2/15/11 

X 

cyber 

02/14, 

02/14, 

04/03, 

Bangladesh 

India 

kinetic 

X 

4/17/11 

7/13/11 

8/1 0/1 1 

cyber 

01/02, 

X 

X 

X 

Iran 

India 

kinetic 

8/1/11 

12/26, 

X 

cyber 

8/25/15 

X 

09/29,  02/25,  02/29,  04/16,  09/13, 

24  days 

k-c 

Kinetic 

cyber 

Pakistan 

India 

1/28/11 

01/19, 

8  days 

c-k 

3/2/11 

03/23, 

21 

k-c 

CMU/SEI-2015-SR-025  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON  UNIVERSITY 
Distribution  Statement  A:  Approved  for  Public  Release;  Distribution  is  Unlimited 


90 


Source 

Target 

Date 

5/14/2011-5/16/11 

X 

7/28/11 

08/15, 

18 

k-c 

10/23/2011-10/24/11 

10/21, 

2 

c-k 

X 

09/13,  11/16,  01/19,  03/23,  04/05, 

X 

09/18,  09/15-16,  11/21,  11/29,  12/11,  01/17 

Turkey 

Iran 

k/c 

12/14/11 

09/03, 

X 

X 

Turkey 

Iraq 

k/c 

10/16/11 

06/25, 

X 

X 

Kinetic 

cyber 

Iran 

Israel 

1/10  -01/11/11 

X 

9/10/11 

X 

9/13/11 

X 

X 

07/06, 

Jordan 

Israel 

kinetic 

4/11/11 

X 

cyber 

X 

09/17, 

Syria 

Jordan 

kinetic 

3/26/11 

04/04, 

9  days 

cyber 

6/17/11 

X 

11/15/11 

X 

11/23/11 

X 
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Source 

Target 

Date 

Iraq 

Libya 

kinetic 

2/18/11 

X 

cyber 

X 

08/25, 

kinetic 

cyber 

India 

Pakistan 

3/26/11 

03/23, 

3 

ck 

4/30/1 1 

X 

5/3/1 1 

X 

06/30-7/1/11 

07/02, 

1 

k-c 

7/12/11 

07/18, 

6 

k-c 

9/1  -  9/2, 

08/16, 

16 

c-k 

9/8/1 1 

X 

9/20/11 

09/24, 

4 

kc 

12/13/11 

11/30, 

13 

X 

02/22,  11/26,  11/28,  03/02,  01/20, 

Iran 

Philippines 

kinetic 

11/25/11 

cyber 

10/30/15 

04/01,  05/30,  08/06,  04/13,  07/06 

26  days 

kinetic 

cyber 

Iran 

Saudi  Arabia 

3/19/11 

X 

4/3/11 

03/31, 

4 

4/6/11 

04/07, 

1 

4/9/2011-4/13/11 

X 
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Source 

Target 

Date 

4/18/11 

X 

4/20-  04/21 , 

X 

10/11/2011  - 

X 

10/17/2011  -  10/20/11 

X 

10/17/11 

X 

10/23/11 

X 

10/25/11 

X 

11/2/2011  -  11/4/11 

X 

11/7/11 

X 

11/18/11 

X 

12/6/11 

X 

12/29/11 

X 

Iraq 

Saudi  Arabia 

kinetic 

4/23/1 1 

X 

cyber 

X 

08/05, 

Libya 

Saudi  Arabia 

kinetic 

3/11/11 

X 

cyber 

X 

01/24,  08/28,  12/17, 

Iran 

Syria 

kinetic 

6/6/2011  -6/7/11 

X 

cyber 

X 

10/04,  10/29,11/04, 

Iraq 

Turkey 

kinetic 

3/30/1 1 

10/16, 

cyber 

2/25/15 

12/05, 

i 

CMU/SEI-2015-SR-025  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON  UNIVERSITY 
Distribution  Statement  A:  Approved  for  Public  Release;  Distribution  is  Unlimited 


Source 

Target 

Date 

Saudi  Arabia 

Turkey 

kinetic 

11/14/11 

X 

cyber 

12/10, 

12/26, 

1/26, 

X 

Syria 

Turkey 

kinetic 

6/25/1 1 

11/23/11 

cyber 

02/26, 

11/03 

20  days 

kinetic 

cyber 

Iran 

United  Kingdom 

1/22/11 

X 

1/24/11 

X 

8/10/11 

X 

8/13/2011  -0  8/15/11 

X 

11/9/11 

X 

11/22/11 

X 

11/25/11 

11/25, 

0 

11/29-  11/30, 

X 

12/1/2011  -  12/4/11 

X 

12/15/11 

X 

12/18/11 

X 

12/22/11 

X 

X 

07/03, 

Pakistan 

United  Kingdom 

kinetic 

6/2/1 1 

10/10/11 

11/2/11 

cyber 

X 

X 

11/27, 
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Source 


Target 


Date 


Syria 

United  Kingdom 

kinetic 

10/8/11 

cyber 

X 

kinetic 

Iran 

United  States 

1/6  -  01/07, 

1/7/11 

1/21/11 

2/3/1 1 

2/14/11 

2/26/1 1 

2/28/11 

4/21/11 

4/25/1 1 

4/30/1 1 

5/9/1 1 

5/21/2011  -  5/22/11 

5/24/1 1 

6/9/1 1 

6/28/1 1 

9/10/11 

10/28/2011  -  10/29/11 

10/31/2011  -  11/1/11 

11/4/11 

CMU/SEI-2015-SR-025  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON  UNIVERSIT 
Distribution  Statement  A:  Approved  for  Public  Release;  Distribution  is  Unlimited 


Source 

Target 

Date 

11/6/11 

X 

11/8/2011  -  11/9/11 

X 

12/5/11 

X 

12/10/11 

X 

12/17/2011  -  12/23/11 

X 

12/27/2011  -  12/29/11 

X 

Saudi  Arabia 

United  States 

kinetic 

3/7/1 1 

X 

cyber 

X 

12/12, 

Cyber  and  Kinetic  Pairings  (2012) 


Source 

Target 

Date 

Brazil 

Argentina 

kinetic 

6/19/12 

cyber 

6/8/15 

Indonesia 

Australia 

10/11/12 

X 

X 

08/24, 

kinetic 

cyber 

India 

Bangladesh 

2/5/12 

X 

2/10/12 

02/11, 

1 

k-c 

2/22/12 

02/25, 

3 

k-c 

3/18/12 

03/14, 

4 

c-k 

4/3/12 

X 
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Source 

Target 

Date 

5/6/12 

05/11, 

5 

k-c 

6/13/12 

X 

6/16/12 

X 

6/19/12 

X 

7/2  -07/03, 

X 

7/28/12 

08/11, 

14 

k-c 

8/29/12 

09/09, 

12 

k-c 

9/2/12 

09/09, 

7 

k-c 

10/18/2012-10/20 

09/30, 

19 

c-k 

10/31/12 

10/29, 

2 

c-k 

11/19/12 

11/20, 

1 

k-c 

12/17/12 

12/09, 

8 

c-k 

12/29/2012-12/30/12 

X 

Pakistan 

Bangladesh 

kinetic 

cyber 

3/7/12 

X 

X 

5/6/, 

8/12/12 

X 

12/2/12 

X 

India 

China 

3/28/12 

X 

3/30/12 

X 

9/4/12 

09/05, 

1 

Malaysia 

China 

11/27/12 

X 
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Source 

Target 

Date 

11/21, 

01/07/04 

Pakistan 

China 

11/8/12 

X 

X 

04/07, 

Bangladesh 

India 

kinetic 

cyber 

1/20/12 

X 

1/24/2012-  1/25/12 

02/26, 

4/3/12 

X 

5/4/12 

X 

8/13/2012-8/14/12 

09/11, 

10/18/12 

10/13, 

X 

02/06,  03/03,  09/1 1 , 09/30,  11/29, 

Pakistan 

India 

1/10/12 

X 

1/18/12 

01/15, 

3/7/12 

02/11, 

4/26/12 

X 

6/15/12 

05/30, 

7/5/12 

X 

7/16/12 

X 

7/18/12 

X 

7/27/12 

X 

8/8/12 

X 
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Source 


Target 


Date 


8/10/12 

8/16/2012-8/17/12 

11/4/12 

11/23/12 

X 

Saudi  Arabia 

Iran 

8/5/12 

Syria 

Lebanon 

4/10/12 

5/3/12 

5/10/12 

8/15/12 

8/28/12 

12/2/12 

12/4/12 

India 

Nepal 

8/31/12 

X 

India 

Pakistan 

1/27/12 

1/28/12 

3/18/12 

4/27/2012-4/28/12 

5/3/12 

5/11/12 
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[5T5] 


Source 

Target 

Date 

7/1/12 

06/13, 

18 

7/12/2012-7/13/12 

08/02, 

19 

8/17/12 

08/06, 

15 

10/12/12 

10/02, 

10 

10/13/12 

X 

10/17/12 

X 

10/27/12 

10/25, 

2 

12/15/12 

12/25, 

10 

12/20/12 

12/25, 

5 

X 

01/01,  01/03,  02/11,  06/04,  06/10-06/13, 

X 

08/02,  11/9,  11/15,  11/16,11/19 

Syria 

Saudi  Arabia 

kinetic 

cyber 

07/18, 

X 

X 

03/05, 

08/02, 

X 

08/11-08/12, 

X 

08/14, 

X 

10/15-10/16, 

X 

Egypt 

South  Africa 

6/28/12 

X 

X 

03/06, 

Egypt 

Syria 

2/19/12 

X 

7/18/12 

X 
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Source 

Target 

Date 

7/21/12 

X 

9/6/12 

09/16, 

10 

k-c 

Turkey 

Syria 

1/10/12 

X 

1/11/12 

X 

3/1/12 

X 

3/7/12 

X 

5/9/12 

04/18, 

21 

c-k 

5/12-05/13 

X 

5/13/12 

X 

8/3/12 

X 

8/4/12 

X 

8/5/12 

X 

10/4/2012  -  10/6/12 

X 

10/6/12 

X 

10/8/12 

X 

10/12/12 

X 

10/14/12 

X 

10/18/12 

X 

10/23/12 

X 

10/30/12 

X 

12/24/12 

X 

Greece 

Turkey 

11/14/12 

10/27/15 

18 

c-k 
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Source 

Target 

Date 

Iran 

Turkey 

1/12/12 

X 

X 

06/15,  11/14, 

Syria 

Turkey 

2/7/12 

02/03, 

4 

c-k 

2/19/2012-2/20/12 

03/08, 

17 

k-c 

6/22/12 

X 

6/23/12 

X 

6/25/2012  -  6/28/12 

X 

7/4/12 

X 

7/20/12 

X 

7/28/12 

X 

8/3/2012-8/5/12 

X 

8/11/12 

X 

9/15/12 

10/07, 

24 

k-c 

12/31/12 

X 

Iran 

United  Kingdom 

1/15/12 

X 

1/31/12 

X 

3/10/12 

X 

4/9/12 

04/24, 

15 

k-c 

Bangladesh 

United  States 

10/19/12 

10/25/12 

09/21, 

X 

28  days 
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Source 

Target 

Date 

Egypt 

United  States 

2/13/12 

7/14/12 

9/11/2012  -  9/15/12 

9/11/12 

9/17/2012  -  9/19/12 

9/23/12 

9/25/12 

9/29/12 

10/12/12 

11/21/12 

India 

United  States 

X 

4/26/12 

7/18/12 

9/26/12 

Indonesia 

United  States 

9/3/12 

11/21/12 

Iran 

United  States 

1/3/12 

1/8/2012-  1/12/12 

1/23/12 

3/2/12 

3/23/12 
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Source 

Target 

Date 

5/22/12 

04/24, 

28 

c-k 

5/29/12 

X 

7/13/12 

X 

8/10/12 

X 

9/12/12 

X 

Malaysia 

United  States 

X 

11/7/2012-  11/8/12 

08/23, 

X 

Saudi  Arabia 

United  States 

9/14/12 

08/16, 

29 

Turkey 

United  States 

8/11/12 

08/24, 

13 

Cyber  and  Kinetic  Pairings  (2013) 


Source 

Target 

Date 

Philippines 

Australia 

kinetic 

Cyber 

1/5/13 

X 

10/30/13 

X 

10/31/13 

X 

X 

10/31/13 
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Source 

Target 

Date 

India 

Bangladesh 

2/7/13 

3/3/13 

4/11/13 

5/22/13 

6/3/2013-  6/4/13 

7/20/13 

9/25/13 

10/7/13 

11/4/13 

11/29/13 

12/15/13 

Indonesia 

Bangladesh 

3/14/13 

X 

X 

Pakistan 

Bangladesh 

10/23/13 

X 

12/17/13 

Syria 

Brazil 

9/24/13 

X 

X 

X 
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Source 

Target 

Date 

Turkey 

Egypt 

2/16/13 

02/25, 

9 

7/4/2013-7/6/13 

07/08, 

2 

7/16/13 

07/15, 

1 

X 

02/16,  07/31,  08/02,  09/23, 

Bangladesh 

India 

1/6/13 

X 

1/13/13 

01/11, 

2  days 

c-k 

1/17/13 

X 

2/2/13 

X 

3/1/13 

X 

3/3/2013-3/4/13 

X 

9/29/2013  -  9/30/13 

X 

11/24/13 

X 

12/15/13 

X 

12/17/13 

X 

Indonesia 

India 

10/21/13 

11/05, 

15 

k-c 

Pakistan 

India 

1/8/2013-1/12/13 

01/07, 

1 

1/15/-  1/16/13 

X 

1/24-  1/25/13 

X 

1/27-  1/28/13 

X 

2/15/13 

02/10 

5 

2/28/13 

X 
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Source 

Target 

Date 

3/13/13 

X 

3/15/13 

X 

4/5/13 

X 

5/6/ -05/0713 

04/23, 

5/25/13 

X 

6/2/13 

X 

6/7/13 

X 

7/8/ -7/9/1 3 

07/04, 

7/21/13 

X 

7/26/13 

X 

08/06-08/19 

08/18, 

8/22/13 

X 

8/25/13 

X 

8/27-08/29/13 

X 

10/19/2013-  10/20/13 

10/17, 

10/24/13 

X 

10/28/13 

X 

12/17/13 

11/26, 

X 

08/11,  11/19,  01/02,  02/10 

X 

08/1 1 , 09/03,  09/1 1 , 

Syria 

Iran 

3/19/13 

04/12-04/13, 

1/25/04 

X 

Turkey 

Iran 

X 

9/25/13 
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Source 

Target 

Date 

08/05, 

Syria 

Jordan 

2/27/13 

4/7/13 

4/23/13 

X 

Syria 

Lebanon 

2/9/13 

4/19/13 

6/9/13 

X 

Syria 

Libya 

X 

03/01, 

Egypt 

Malaysia 

8/29/13 

X 

Indonesia 

Malaysia 

6/21/13 

X 

Saudi  Arabia 

Malaysia 

7/29/2013  -  7/30/13 

X 

Malaysia 

Nigeria 

1/23/13 
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X 


X 

X 

04/19, 

12/27,  06/20 


02/13, 

04/12, 

05/31, 

02/15,  02/28, 


9/23/13 

X 


X 

9/23/13 


8/10/13 

X 


X 

01/20, 


11/27/13 


flEl 


Source 

Target 

Date 

X 

India 

Pakistan 

1/6/2013-1/11/13 

1/14/13 

1/15/13 

1/17/13 

1/22/13 

1/24/13 

1/30/13 

1/31/13 

2/15/13 

2/16/13 

2/25/13 

2/27/13 

3/1/13 

3/3/13 

3/6,  03/07, 

3/10/13 

3/25/13 

3/30-  03/31 , 

4/25/13 

4/27/13 

4/30/13 

5/6-05/07 

5/14/13 
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Source 


Target 


Date 


5/20/13 

7/21/13 

7/27/13 

8/9/13 

08/11,  08/12 

8/17/13 

08/21-08/23 

9/3/13 

9/5/13 

9/16/13 

10/2/13 

10/25/13 

11/28/13 

12/17/13 

Syria 

Russian  Federation 

11/15/13 

X 

Syria 

Saudi  Arabia 

04/17, 

5/21/13 

5/29/13 

10/4/13 

Iran 

Syria 

5/4/13 

X 
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X 


X 


x 


Source 

Target 

Date 

Indonesia 

Turkey 

6/10/13 

X 

X 

X 

02/19, 

03/26, 

Pakistan 

Turkey 

9/19/13 

X 

X 

06/12, 

Syria 

Turkey 

2/18/13 

X 

2/24/13 

X 

7/20/13 

X 

12/28/13 

12/04, 

24 

X 

01/13,  05/04,  06/03,  10/01,  11/14,12/04, 

Argentina 

United  Kingdom 

1/2/13 

X 

1/31/2013  -  2/2/13 

X 

2/7/2013-2/8/13 

X 

Iran 

United  Kingdom 

4/20/13 

X 

10/8/2013  -  10/9/13 

X 

11/19/13 

X 

12/11/13 

X 

01/11,  07/14, 

12/14/13 

X 

12/28/13 

X 

Pakistan 

United  Kingdom 

5/17/13 

X 
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Source 


Target 


Indonesia 


United  States 


United  States 


Pakistan 


United  States 


6/20/13 


10/30/13 


7/17/13 


09/25/2031  -9/26/2013 

9/30/13 

10/1/13 

10/15/13 


10/17/2013,  10/18/13 


12/18/13 


4/17/13 

8/26/13 


10/30/2013-  10/31/2013 

11/22/13 
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Source 

Target 

Date 

11/25/13 

Turkey 

United  States 

1/14/13 

2/24/13 

2/28/13 

3/2/13 

11/20/13 
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This  study  is  structured  to  allow  for  the  examination  of  actors  involved  in  cyber  events  (specifically  web  defacements)  where  those  events 
relate  to  kinetic  activities,  by  using  culture  as  the  framework  in  which  the  events  are  discussed.  This  study  was  designed  to  profile  cyber  ac¬ 
tors,  and  to  examine  the  time  interval  between  cyber  and  kinetic  events  in  order  to  gain  greater  insights  into  nation-state  cyber  responses  to 
kinetic  events. 

The  study  results  present  findings  about  the  relationships  of  cultural  values  and  the  cyber  and  kinetic  actions  that  have  been  observed  and 
recorded. 
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